Gamification & XP System

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:49 AM UTC
• Version:
  1.1.0

Overview

This is a disclosed gamification integration for ClawdBot, with the main caution being its sensitive Supabase service key and multi-user leaderboard visibility.

Install only if you trust the ClawdBot backend that will handle the Supabase service role key. Use a dedicated Supabase project or tightly separated database for gamification data, avoid reusing a service key for unrelated private tables, and confirm whether leaderboard participation exposes user XP, ranks, streaks, or achievement history to other users.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly advertises a multi-user leaderboard and progress comparison but does not warn users that their XP, rank, or achievement data may be visible to others. In a productivity context, this can expose behavioral patterns and participation data without informed consent, especially if the backend enables broad leaderboard access by default.

VirusTotal

66/66 vendors flagged this skill as clean.