clawScape

• Outcome: Review
• Latest audit: May 28, 2026 · 2:45 PM UTC
• Version: 1.0.9

Overview

This skill is a disclosed game bridge and AI loop, but it needs review because it exposes unauthenticated local game-control and telemetry APIs and stores social gameplay memory.

Install only if you trust the local machine and browser environment. Keep ports 18765 and 18766 active only while using the game, do not expose them to a network, avoid untrusted web pages while the bridge is running, and review or delete ~/.openclaw/workspace/clawspace memory files as needed. Do not set MINIMAX_API_KEY unless you intentionally want third-party LLM use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documented behavior expands from startup automation into persistent autonomous decision-making and long-running gameplay control. That scope expansion matters because autonomous loops can continue acting, interacting, and writing data after the user expected only a one-time launch flow.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill stores long-term memory, logs, player encounters, and conversation history even though its declared purpose is just opening a virtual social space. Unnecessary retention increases privacy risk and creates durable local records that could later be exposed, misused, or accessed by other tools.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The bridge starts an additional HTTP API on localhost:18766 that allows callers to enumerate clients, fetch cached perception/map data, and send arbitrary game commands without any authentication or authorization checks. Even though it binds to 127.0.0.1, any local process, browser-based localhost request, or malware on the host can abuse it to surveil gameplay state or control connected clients, which exceeds the stated startup/bridge purpose.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The WebSocket bridge accepts unauthenticated messages such as sendCommand, bridge_requestPerception, bridge_getPerception, bridge_list_clients, and related query/control operations, then forwards commands directly to registered game clients or returns sensitive cached state. Any process able to connect to the bridge can impersonate an OPENCLAW/controller client, issue actions, and harvest detailed in-game telemetry without user approval.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The implementation is materially broader than a simple launcher: it maintains long-lived client registries, caches perception/world-state, forwards chat, tracks movement, aggregates map-manager data, computes paths, and exposes that state through APIs. This overbroad capability increases attack surface and makes the bridge a persistent surveillance/control service rather than a narrow startup helper, so compromise or misuse has much wider consequences.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code makes outbound requests to an external LLM service and uses an API key from environment variables, despite the skill metadata only describing local startup/bridge automation. This creates undisclosed data egress and expands the trust boundary, potentially sending gameplay or user-derived data to a third party without necessity or consent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says this skill only opens and connects clawSpace, but the code implements a persistent autonomous agent that reads local game perception data and issues movement, dialogue, and interaction commands. This is a significant capability mismatch that can mislead users and reviewers, enabling unintended autonomous actions inside the game environment under the guise of a simple launcher.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata says it only starts and connects clawSpace, but this file creates a persistent workspace memory system, log files, and retained state across runs. That mismatch is security-relevant because users would not reasonably expect behavioral tracking and data retention from a simple launcher, reducing informed consent and increasing privacy risk.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This code does much more than launch/connect the game: it establishes a control loop, reconnects automatically, fetches perception data, moves the player, explores maps, and sends dialogue to other entities. In the context of a startup skill, undisclosed autonomous control is dangerous because it grants the skill ongoing agency inside the game world without explicit user approval.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The file persistently stores daily events, map visits, NPC conversations, player encounters, goals, facts, and consolidated history under the user's workspace. For a skill whose stated purpose is merely opening clawSpace, this collection is unnecessary and increases privacy and surveillance risk, especially because other players' identifiers and names are retained.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The exploration and free-decision logic autonomously greets nearby players, roams maps, and chooses actions based on random behavior/personality parameters. In a launcher skill, this is context-inappropriate and risky because it can impersonate user intent, create unwanted social interactions, and operate continuously once started.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This file implements long-term behavioral profiling and persistence of conversations, player identities, goals, and personality traits, while the skill metadata only describes launching clawSpace and its bridge. That mismatch creates an undisclosed data-collection capability that can surprise users, expand the privacy attack surface, and retain sensitive interaction history beyond what is necessary for startup automation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The code goes beyond a simple startup workflow by continuously writing interaction history to disk and curating it into persistent state. In this skill context, that is dangerous because users invoking a launcher would not reasonably expect ongoing surveillance-style logging, making the hidden functionality more suspicious and privacy-invasive.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs automatic bridge startup and browser launch without prominently warning that it will execute local commands and open applications. Automatic host changes without a clear warning or confirmation can surprise users and weaken safe-execution expectations.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill describes writing memory and log files to local storage but does not clearly warn users about persistent data collection and retention. Silent or poorly disclosed local storage is risky when the data includes interaction history, goals, and inferred summaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The HTTP perception endpoint returns cached player state including self, position, nearby entities, monsters, NPCs, and map data without authentication and without any visible disclosure or consent mechanism. This exposes behavioral and situational game telemetry to any local requester and can facilitate profiling, botting, or other unauthorized automation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The HTTP endpoints for map info and transport points expose world-state data useful for navigation and automation, again with no authentication or disclosure. In this skill context, that data is not necessary for merely opening a social space, so the silent exposure makes misuse for automation and reconnaissance more concerning.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The LLM request sends prompt content to a third-party API and attaches a bearer credential, but there is no user-facing disclosure, consent flow, or indication of what data may leave the local system. In the context of a skill advertised as automatic startup/connection only, this hidden network behavior is especially concerning because users would not reasonably expect remote processing or secret-backed API usage.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: These logging paths persist raw events including NPC messages, player identifiers, names, goals, and free-form thoughts to disk without any visible notice, consent, or data minimization. Such silent collection can expose sensitive user content locally, enable later misuse by other code on the host, and violate user expectations for a launcher-type skill.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly retains and summarizes events, encounters, and conversation-related data in long-term storage. Persisting social interaction data increases privacy exposure, especially when the retention is broad and the stated purpose does not require durable profiling.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The instructions direct the agent to load, update, and persist a full character memory including prior conversations and encountered players. This creates a persistent profile of interactions and identities that can outlive the immediate session and expose sensitive behavioral history.

Static analysis

Detected: suspicious.env_credential_access, suspicious.nonstandard_network

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/ai_launcher.js:102

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/ai_loop_ws.js:12

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/ai_loop.js:25

WebSocket connection to non-standard port detected.

Warn

• Code: suspicious.nonstandard_network
• Location: scripts/ai_loop_ws.js:298