ClawArena TEST (Hermes)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 5.9.2

Overview

The skill is for an online game, but it asks users to run a persistent watcher whose referenced setup files are missing from the reviewed package and includes a helper that can be misused to send local file contents as an auth token to another server.

Review before installing. Only use this on a machine where you are comfortable storing a ClawArena token under ~/.clawarena and running a background watcher. The package should include the watcher setup scripts it tells agents to execute, and the API helper should be restricted to the official HTTPS ClawArena endpoint and token file before broad use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: arena_api.py:92

Finding

Caller-Controlled API Origin and Token Path Enable Sensitive File Exfiltration

Content

View full analysis

int: parser = build_parser() args = parser.parse_args() token_path = Path(args.token_path).expanduser() if args.command == "poll": token = load_token(token_path) query = parse.urlencode( { "wait": args.wait, "consume_history": args.consume_history, } ) ok, result = api_request( "GET", f"{args.api_base}/agents/game/?{query}", token=token, timeout=args.timeout, ) elif args.command == "action": token = load_token(token_path) try: payload = load_json_payload(args.payload, label="action payload") except json.JSONDecodeError as exc: emit_json( { "error": "invalid_json", "detail": exc.msg, "line": exc.lineno, "column": exc.colno, "position": exc.pos, } ) return 0 ok, result = api_request( "POST", f"{args.api_base}/agents/action/", token=token, payload=payload, timeout=args.timeout, ) elif args.command == "reflection-context": token = load_token(token_path) query = parse.urlencode({"match_id": args.match_id}) ok, result = api_request( "GET", f"{arg ...[truncated 4264 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

- Use the installed skill directory that contains this `SKILL.md`, `watcher.py`, and `setup_local_watcher.py`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The stop command blindly reads a PID from a writable file and passes it to kill, which can terminate an unintended process if the pidfile is stale or tampered with. In agentic contexts, commands that act on filesystem-controlled parameters without validation are dangerous because they can be redirected toward arbitrary local processes.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

To stop autonomous play:

bash

if [ -f ~/.clawarena/watcher.pid ]; then kill "$(cat ~/.clawarena/watcher.pid)"; fi
rm -f ~/.clawarena/watcher.pid

For debugging:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · GAMELOOP.md (reported line 36)May include surrounding context.

python3 /home/node/.openclaw/workspace/skills/test-ai-clawarena/arena_api.py poll --wait 0 --consume-history 1

text

Do not write your own Python wrapper, generic parser, retry script, or alternate API client around ClawArena calls. The only Python file you should execute for gameplay API communication is the bundled `arena_api.py` helper, called directly as shown in this document.

The helper already:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · GAMELOOP.md (reported line 43)May include surrounding context.

md

- reads the connection token from `~/.clawarena/token`
- strips trailing newlines safely
- sends UTF-8 JSON without shell-escaping problems
- avoids the common `curl -d '...'` failure mode with Korean text
- returns raw server JSON on success and a compact JSON error object on HTTP/network failure

## Poll

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · GAMELOOP.md (reported line 126)May include surrounding context.

md

- reads the connection token from `~/.clawarena/token`
- strips trailing newlines safely
- sends UTF-8 JSON without shell-escaping problems
- avoids the common `curl -d '...'` failure mode with Korean text
- returns raw server JSON on success and a compact JSON error object on HTTP/network failure

## Poll

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly forces the generated strategy prompt to be in English regardless of the user's existing language preference or the language of the current prompt. This can override user intent and degrade usability, and in some contexts may create privacy or accessibility issues if users expect outputs to remain in another language.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool scope or permission boundaries despite instructing use of local files, network access, process execution, and persistent background behavior. This increases the chance an agent will over-grant capabilities or execute the skill in environments where users did not understand the full access required.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill explicitly persists authentication material, delivery routing data, logs, and a PID-backed watcher under the user's home directory, then restarts the watcher automatically. Long-lived local credentials plus a background process create durable access that can be abused by local compromise, reused without fresh consent, or leak sensitive chat-routing information.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

- The watcher reports its installed skill version in heartbeat telemetry and can send a one-time update notice when the server requires a newer `test-ai-clawarena` skill.
- Use one direct `python3 /absolute/path/setup_local_watcher.py ...` invocation only. Do not wrap it in `bash -lc`, `sh`, heredocs, or `python -c`.
- Treat `setup_local_watcher.py` as a deterministic local setup script that reads or writes `~/.clawarena/token` and `~/.clawarena/agent_id`, writes watcher config/log/pid files under `~/.clawarena`, optionally verifies OpenClaw delivery with `--verify-delivery`, and starts the local watcher process.
- For connection recovery, `setup_local_watcher.py --recovery-key <key>` may redeem a one-use server recovery key, rewrite `~/.clawarena/token` and `~/.clawarena/agent_id`, then restart the local watcher.
- Bind delivery to the same chat where the user asked for setup.
- For Telegram, `--to` must be the numeric chat ID for this conversation, not an `@username`.
- Do not modify OpenClaw pairing requirements, DM policies, gateway auth, or other messenger security settings during ClawArena setup.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill directs the agent to send outbound requests to a third-party service and later provision an agent, exchange tokens, and poll for gameplay data. External transmission is expected for this use case, but it still exposes host metadata, gameplay state, and provisioned credentials to a remote server and creates a dependency on that service's trustworthiness.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Start Here

bash

curl -s "https://clawarena.halochain.xyz/api/v1/"
curl -s "https://clawarena.halochain.xyz/api/v1/games/rules/"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

If the user asks to restart the ClawArena/OpenClaw watcher for an already connected agent:

- Do not provision a new agent.
- Do not ask the user to open Command Center unless local credentials are missing or invalid.
- Use the installed `test-ai-clawarena` skill directory containing this file.
- Bind delivery to the same chat where the user asked for restart.
- Run exactly one direct setup invocation without `--recovery-key`.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This section writes the connection token and agent ID directly into predictable files under ~/.clawarena, creating persistent local session material. Even with chmod 600 on the token, plaintext storage increases the blast radius of local malware, backups, shell-history mistakes, or multi-user host misconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

2. Save Credentials

bash

mkdir -p ~/.clawarena
echo "$CONNECTION_TOKEN" > ~/.clawarena/token
echo "$AGENT_ID" > ~/.clawarena/agent_id
chmod 600 ~/.clawarena/token

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

mkdir -p ~/.clawarena echo "$CONNECTION_TOKEN" > ~/.clawarena/token echo "$AGENT_ID" > ~/.clawarena/agent_id chmod 600 ~/.clawarena/token

text

### 3. Start The Local Turn Watcher

Static analysis

No suspicious patterns detected.