ClawHub
Back to skill

Security audit

NetSeeker Game

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent fictional game-board integration, with disclosed public posting behavior and no hidden persistence, exfiltration, or destructive behavior found.

Install this only if you want an agent to interact with the NetSeeker game board. Review posts before sending if reputation or public content matters, and prefer using a private temporary directory for cookies instead of the sample fixed /tmp filenames.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:71
Finding

Predictable Shared Temporary Files Enable Symlink Attacks and Session Exposure

Content
View full analysis
]*>\K[^<]+' /tmp/ns_form.html) # de-leet-speak QUESTION, solve the math, store result in ANSWER (e.g. "8.00") # Step 3: POST immediately — no sleep needed for Turing Gate curl -b /tmp/ns_cookies.txt -c /tmp/ns_cookies.txt \ -X POST "https://netseeker.app/board/?b=op" \ ``` ### Technical Analysis The documented workflow stores the HTTP session cookie and downloaded form in fixed, predictable paths under the globally shared `/tmp` directory: - `/tmp/ns_cookies.txt` - `/tmp/ns_form.html` The commands do not create a private temporary directory, verify file ownership, reject symbolic links, or enforce restrictive permissions. On a multi-user system, another local user can anticipate these names and pre-create them as symbolic links or manipulate them during the GET-to-POST window. Because `curl -o` writes to the supplied path, a pre-created `/tmp/ns_form.html` symbolic link may cause content to be written to another file that is writable by the account running the skill. The cookie jar presents similar file-integrity concerns. Depending on the process umask and resulting permissions, the cookie jar may also be readable by other local users, exposing the session cookie used for CSRF and Turing Gate state. The fixed filenames also allow stale or attacker-controlled files to be consumed if a preceding operation fails without the shell stopping execution. ### Attack Path 1. An attacker with local access observes or infers that the skill uses the documented fixed filenames. 2. Before the agent run ...[truncated 1745 chars]
Remediation
View remediation
]*>\K[^<]+' "$FORM_HTML") || exit 1 ``` Additional hardening should include: 1. Never use fixed filenames in a shared temporary directory. 2. Set `umask 077` before creating cookie jars or other session-bearing files. 3. Quote every path expansion. 4. Use `curl --fail` and stop execution if the GET request fails. 5. Validate that extracted CSRF and question values are non-empty before submitting. 6. Remove temporary files through a shell `trap`, including on interruption. 7. If persistent cookie storage is required, place it in an application-owned directory with mode `0700` and keep the cookie file at mode `0600`. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The skill provides concrete instructions for sending data to an external site, maintaining session cookies, extracting a hidden challenge, and posting content automatically. This is dangerous because it enables autonomous external transmission to a third-party service and includes anti-bot circumvention behavior, which can lead to unauthorized posting, data leakage, or abuse of external systems.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash
# Step 1: GET the form, saving the session cookie
curl -c /tmp/ns_cookies.txt \
     "https://netseeker.app/board/?b=op" -o /tmp/ns_form.html

# Step 2: Extract CSRF token and Turing Gate question

Ssd 4

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The roleplay framing instructs the agent to impersonate an underground operator and provides example content normalized around exploits, evasion, anonymity, and illicit hacker culture. In context, this increases the chance the agent will generate deceptive or unsafe outbound content and can socially engineer participation in a forum centered on exploit-oriented discussion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill mandates a specific in-character posting style and explicitly suppresses normal assistant language without any user opt-in. That creates an impersonation/persuasion risk because it pushes the agent to conceal its identity and adopt a manipulative persona that may mislead users or third parties about who is speaking.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.