ClawHub
Back to skill

Security audit

Aavegotchi Renderer Bypass

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated Aavegotchi rendering purpose, but it needs review because it can fetch renderer-supplied URLs and writes predictable files to /tmp by default.

Review before installing. Use only if you expect outbound calls to Goldsky and Aavegotchi, run it as an unprivileged user, and choose a private output directory instead of shared /tmp. The publisher should add domain allowlisting for image downloads and safer exclusive file creation before this is treated as low-risk.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/render-gotchi-bypass.mjs:197
Finding

Renderer Response Permits Server-Side Request Forgery Through Unrestricted Asset URLs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/render-gotchi-bypass.mjs:242
Finding

Predictable Files in Shared Temporary Directory Permit Symbolic-Link File Overwrite

Content
View full analysis
-render-batch.json` - `gotchi--full.png` - `gotchi--headshot.png` By default, these files are created directly under the shared `/tmp` directory. `fs.writeFileSync` follows existing symbolic links and overwrites existing files unless exclusive creation flags are used. On a multi-user system, another local user can predict the filenames and create ...[truncated 1808 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
node scripts/render-gotchi-bypass.mjs --token-id 6741

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
node scripts/render-gotchi-bypass.mjs --token-id 6741

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill performs network actions but does not declare any tool scope or permission boundaries, which makes its capabilities opaque to users and policy enforcers. In an agent environment, undeclared network access increases the chance of unintended outbound requests and reduces the effectiveness of least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs saving raw API responses and rendered assets to local disk without warning the user or requiring explicit consent. Unannounced file writes can create privacy, storage, and data-handling risks, especially when writing to shared or sensitive locations like /tmp in multi-tenant or automated environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill directs transmission of user-supplied or derived data to external services at Goldsky and Aavegotchi without any explicit trust boundary, consent language, or domain restriction metadata. Even if the purpose is functional, external transmission exposes data and behavior to third parties and can be risky in agent systems where users may not expect remote lookups or POST requests.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
1. Extract `tokenId` from direct input or inventory URL.
2. Query Goldsky Base core subgraph:
`https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn`
3. Derive hash in renderer format:
`<Collateral>-<EyeShape>-<EyeColor>-<Body>-<Face>-<Eyes>-<Head>-<LeftHand>-<RightHand>-<Pet>`
4. Call `POST https://www.aavegotchi.com/api/renderer/batch` with:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/render-gotchi-bypass.mjs (reported line 7)May include surrounding context.

js
import path from "node:path";

const GOLDSKY_ENDPOINT =
  "https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn";
const DAPP_BASE = "https://www.aavegotchi.com";

const COLLATERAL_MAP = {

Static analysis

No suspicious patterns detected.