ClawHub
Back to skill

Security audit

Casino Game For OpenClaw Agent

Security checks for vulnerabilities and agentic risk

Overview

This casino skill is not clearly malicious, but it needs review because it installs an unaudited, unpinned npm server and has broad activation plus local data exposure concerns.

Install only if you trust the npm package publisher and are comfortable running a local casino server under your user account. Prefer a pinned, reviewed package version or included server source, and avoid using sensitive agent names or credentials until local endpoint access, token handling, and data deletion are documented.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned External npm Package Introduces Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–19
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code Snippet

yaml
install:
  - id: npm
    kind: npm
    package: "openclaw-casino"
    bins: ["casino-server"]
    label: "Install Casino Server (npm)"

Technical Analysis

The skill declares the external npm package openclaw-casino without an exact version, integrity hash, lockfile, or canonical source reference. Consequently, installation may resolve package content that differs from the content originally reviewed.

The dependency exposes the executable casino-server. Its implementation is not present in the audited project, which contains only README.md and SKILL.md. The package's installation lifecycle and runtime behavior therefore cannot be verified from this artifact.

This is a supply-chain weakness rather than proof that the named package is malicious. Exploitation would require the registry package, a future release, or its publishing account and dependency chain to be compromised or otherwise unsafe.

Attack Path

  1. A user or OpenClaw installation process reads the npm installation declaration.
  2. npm resolves the mutable, unpinned openclaw-casino package version available at installation time.
  3. An attacker who controls or compromises that package, its publisher account, or a transitive dependency publishes a malicious release.
  4. Package lifecycle behavior may execute during installation, or malicious logic may run when the exposed casino-server command is invoked.
  5. The payload executes with the permissions of the account performing the installation or starting the server.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's privileges. Within those privileges, a malicious package could read or alter accessible files and environment variables, interact with local services, make networ ...[truncated 299 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the package to a reviewed exact version rather than allowing mutable version resolution.
  2. Commit a lockfile containing registry-resolved integrity metadata.
  3. Document and verify the package's canonical npm registry entry and source repository.
  4. Include the server source in the reviewed artifact so its installation and runtime behavior can be audited.
  5. Verify package provenance and signatures where supported by the package ecosystem.
  6. Disable npm lifecycle scripts during installation where operationally feasible, then explicitly run only reviewed setup steps.
  7. Perform dependency and transitive-dependency scanning before release and on every version update.
  8. Correct the artifact inconsistency: SKILL.md lines 32–34 and README.md lines 31–32 reference scripts/casino-server.js, but that file is absent, while README.md line 25 contains a placeholder repository URL.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

md
node ~/.openclaw/skills/casino/scripts/casino-server.js

# Register an agent
curl -X POST http://localhost:3777/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "MyAgent", "strategy": "aggressive"}'

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance is broad enough to trigger on common gambling- or game-related words, which can cause the agent to invoke this skill unexpectedly in ordinary conversation. Over-broad activation increases the chance of unintended tool use and can steer users into interacting with a local service they did not explicitly ask to use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation encourages use of a local HTTP/WebSocket server and persistent storage but does not clearly warn that agent identifiers, play history, leaderboard data, and possibly tokens are retained and exposed through local endpoints. Even on localhost, other local processes, browser extensions, or shared-user environments may access this data, creating privacy and unauthorized access risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

bash
# Register a new agent — receives 1000 free chips
curl -X POST http://localhost:3777/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "MyAgent", "strategy": "balanced"}'

Static analysis

No suspicious patterns detected.