ClawHub
Back to skill

Security audit

Casino Game For OpenClaw Agent

Security checks for vulnerabilities and agentic risk

Overview

This casino skill is not clearly malicious, but it needs review because it installs an unaudited, unpinned npm server and has broad activation plus local data exposure concerns.

Install only if you trust the npm package publisher and are comfortable running a local casino server under your user account. Prefer a pinned, reviewed package version or included server source, and avoid using sensitive agent names or credentials until local endpoint access, token handling, and data deletion are documented.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding
Unpinned External npm Package Introduces Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 14–19 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml install: - id: npm kind: npm package: "openclaw-casino" bins: ["casino-server"] label: "Install Casino Server (npm)" ``` ### Technical Analysis The skill declares the external npm package `openclaw-casino` without an exact version, integrity hash, lockfile, or canonical source reference. Consequently, installation may resolve package content that differs from the content originally reviewed. The dependency exposes the executable `casino-server`. Its implementation is not present in the audited project, which contains only `README.md` and `SKILL.md`. The package's installation lifecycle and runtime behavior therefore cannot be verified from this artifact. This is a supply-chain weakness rather than proof that the named package is malicious. Exploitation would require the registry package, a future release, or its publishing account and dependency chain to be compromised or otherwise unsafe. ### Attack Path 1. A user or OpenClaw installation process reads the npm installation declaration. 2. npm resolves the mutable, unpinned `openclaw-casino` package version available at installation time. 3. An attacker who controls or compromises that package, its publisher account, or a transitive dependency publishes a malicious release. 4. Package lifecycle behavior may execute during installation, or malicious logic may run when the exposed `casino-server` command is invoked. 5. The payload executes with the permissions of the account performing the installation or starting the server. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's privileges. Within those privileges, a malicious package could read or alter accessible files and environment variables, interact with local services, make networ ...[truncated 299 chars]
Remediation
## Remediation Suggestions 1. Pin the package to a reviewed exact version rather than allowing mutable version resolution. 2. Commit a lockfile containing registry-resolved integrity metadata. 3. Document and verify the package's canonical npm registry entry and source repository. 4. Include the server source in the reviewed artifact so its installation and runtime behavior can be audited. 5. Verify package provenance and signatures where supported by the package ecosystem. 6. Disable npm lifecycle scripts during installation where operationally feasible, then explicitly run only reviewed setup steps. 7. Perform dependency and transitive-dependency scanning before release and on every version update. 8. Correct the artifact inconsistency: `SKILL.md` lines 32–34 and `README.md` lines 31–32 reference `scripts/casino-server.js`, but that file is absent, while `README.md` line 25 contains a placeholder repository URL.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Content
node ~/.openclaw/skills/casino/scripts/casino-server.js

# Register an agent
curl -X POST http://localhost:3777/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "MyAgent", "strategy": "aggressive"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation guidance is broad enough to trigger on common gambling- or game-related words, which can cause the agent to invoke this skill unexpectedly in ordinary conversation. Over-broad activation increases the chance of unintended tool use and can steer users into interacting with a local service they did not explicitly ask to use.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The documentation encourages use of a local HTTP/WebSocket server and persistent storage but does not clearly warn that agent identifiers, play history, leaderboard data, and possibly tokens are retained and exposed through local endpoints. Even on localhost, other local processes, browser extensions, or shared-user environments may access this data, creating privacy and unauthorized access risks.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Register a new agent — receives 1000 free chips
curl -X POST http://localhost:3777/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "MyAgent", "strategy": "balanced"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.