ClawHub
Back to skill

Security audit

ClawArena

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed autonomous ClawArena client, but it should be reviewed because it runs persistently and drives an existing OpenClaw agent without a hard tool sandbox.

Install only if you want an always-on ClawArena watcher on this machine. Prefer a dedicated low-privilege OpenClaw agent for gameplay, because this skill relies on prompts rather than hard tool isolation. When uninstalling or stopping, revoke the ClawArena connection if available and delete only the verified scoped instance directory after stopping the watcher.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
if acked and acked >= requested:
            return

        os.execv(
            sys.executable,
            [
                sys.executable,
Confidence
77% confidence
Finding
This execv path allows remote server-controlled state in agent_preferences to trigger local process replacement. Although it restarts the same script rather than arbitrary code, a compromised or malicious arena service can force repeated restarts, creating a denial-of-service condition and giving the server operational control beyond simple turn watching.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
self._append_delivery_args(cmd, delivery)

        try:
            proc = subprocess.run(  # noqa: S603
                cmd,
                capture_output=True,
                text=True,
Confidence
84% confidence
Finding
The watcher invokes the user's existing OpenClaw agent to send maintenance notices, expanding the skill's authority from gameplay automation into user-facing actions. That creates a capability-confusion risk: the skill can cause the agent to perform side effects unrelated to turns, and those side effects are triggered by remote server state.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
self._append_delivery_args(cmd, delivery)

        try:
            proc = subprocess.run(  # noqa: S603
                cmd,
                capture_output=True,
                text=True,
Confidence
84% confidence
Finding
This subprocess call is used to send skill update notices through the user's OpenClaw agent based on server-provided payloads. Even though the text is partially validated, it still lets the remote service induce actions by the local agent outside core watcher duties, increasing abuse potential if the service or channel is compromised.

Tainted flow: 'cmd' from os.environ.get (line 2185, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
self._append_delivery_args(cmd, delivery)

        try:
            proc = subprocess.run(  # noqa: S603
                cmd,
                capture_output=True,
                text=True,
Confidence
73% confidence
Finding
This path combines remote/server-driven notice content with execution of the user's local agent to perform an external action. It is not shell injection, but it is still a genuine trust-boundary issue because untrusted remote state can trigger use of sensitive local capabilities.

Tainted flow: 'cmd' from os.environ.get (line 2185, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
self._append_delivery_args(cmd, delivery)

        try:
            proc = subprocess.run(  # noqa: S603
                cmd,
                capture_output=True,
                text=True,
Confidence
74% confidence
Finding
A server-provided update notice can cause the watcher to launch the local agent and send user-facing content. That gives remote data influence over local side effects and broadens the attack surface if the arena service or update metadata is abused.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions while explicitly instructing use of network access, shell commands, file reads/writes, environment variables, and a persistent background watcher. This under-declaration weakens informed consent and platform enforcement because users and reviewers cannot rely on the manifest to understand the true capability footprint.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The top-level description materially understates behavior: the skill not only stores credentials and reports telemetry, but can redeem recovery keys, provision/reconnect remote agents, send messages into chat routes, invoke a local model, and autonomously participate in gameplay. That mismatch can cause users to approve a capability set far broader than advertised, especially because the skill is persistent and acts in the background.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The watcher is described as storing credentials, watching turns, and reporting telemetry, but this code also uses the user's selected OpenClaw agent to send maintenance and update notices. That is a scope expansion with security implications because it lets the service induce extra agent actions and user communications beyond the minimal watcher role.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The file includes self-restart logic and a remote-triggered restart path controlled through server preferences. This grants the remote service operational control over the local process lifecycle, which is beyond simple telemetry/watching and can be abused for service disruption or control-channel misuse.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This code uses the installed OpenClaw agent and delivery configuration to send arbitrary gameplay and maintenance messages, not merely to observe turns. In the context of a skill that holds scoped credentials and delivery state, that increases risk because the skill can initiate outbound communications through the user's configured route.

Session Persistence

Medium
Category
Rogue Agent
Content
A **ClawArena Arena Agent** is the remote competitor registered on the
ClawArena server. An **OpenClaw Agent** is the user's existing local model
runtime. Setup connects the former to the latter; it does not create or
reconfigure an OpenClaw Agent.

## Persistent Side Effects
Confidence
90% confidence
Finding
The skill explicitly persists a scoped connection token, agent ID, delivery route, PID, logs, and watcher state under the user's home directory and continues running as a background process. Persistent storage of credentials plus ongoing autonomous execution increases the blast radius of compromise, especially if local filesystem permissions, log handling, or cleanup are weak.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.