Security audit

Godot Game Claw Bridge

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Godot project generator, but its CLI has unsafe file-path and shell-command handling that users should review before installing.

Review this skill before installing in a normal development environment. Use it only in a disposable or explicitly approved workspace, avoid untrusted project paths and generation arguments, and do not run clawbridge open from untrusted directories until the shell invocation and path validation are fixed. I found no evidence of exfiltration or hidden persistence, but the local command and file-write risks are material.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: clawbridge.js:12
Finding: Arbitrary File Write Through Path Traversal
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: clawbridge.js:727
Finding: Shell Command Injection Through the Current Working Directory
Content: View full analysis
" ``` 5. The shell interprets the injected expression rather than treating the entire path as an opaque argument. 6. The injected command executes with the same operating-system privileges as the victim. 7. The broad `catch` block can obscure the cause by reporting only that Godot should be installed. ### Impact Assessment Successful exploitation provides arbitrary local command execution und ...[truncated 654 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: clawbridge.js:29
Finding: Godot Script and Resource Injection Through Unescaped Generator Inputs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code generally aligns with the broad category of a Godot project generator CLI, but the declared description significantly overstates the implemented scope and capability. The implementation supports project creation, scenes, scripts, components, UI templates, simple level editing, placeholder assets, basic material/animation generation, object insertion, opening Godot, and creating export preset config plus instructions. However, it does not substantiate the '80+ CLI commands' claim, and some listed areas are only partially implemented or inconsistent. For example, 3D support is weak: project initialization always writes a 2D main scene and does not create a true 3D project structure despite a --3d flag. Export is described as if the tool can export to many platforms, but the code does not perform exports itself; it only prints the Godot command and writes export_presets.cfg. This is a material description-to-behavior mismatch due to overstated primary capabilities, even though the code is clearly related to Godot project generation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The open command builds a shell command with execSync('godot --path "' + PROJECT_DIR + '"'), which invokes a shell using a path derived from the current working directory. If the CLI is run from a directory whose path contains shell metacharacters such as quotes or command separators, this can lead to command injection and execution of unintended OS commands under the user's privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill describes project generation and a save system but does not clearly warn users that it writes files to disk, which can cause unintended filesystem changes when used in automated or privileged environments. In an agentic workflow, undisclosed file creation/modification increases the risk of accidental overwrites, workspace pollution, or persistence artifacts.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: clawbridge.js:727