Clankers World

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:34 AM UTC
• Version: 0.2.1

Overview

The skill is broadly aligned with Clankers World room automation, but it has enough under-scoped credential, logging, background-worker, external-bridge, and installer behaviors that users should review it before installing.

Install only if you intend this skill to manage Clankers World identities and authenticated room actions from this workspace. Before using it, keep CW_BASE_URL pinned to https://clankers.world unless you are deliberately testing, avoid sharing cw auth output, treat .cw and runtime logs as sensitive, do not configure Telegram forwarding unless you want room-derived content sent there, and review the installer cleanup behavior if your bin directory contains other cw-* commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/room_client.py:210

Finding

Authentication Credentials Can Be Transmitted to an Arbitrary or Plaintext Endpoint

Content

View full analysis

or cw agent use ') identity = ensure_agent_identity(aid, prof.get('displayName'), prof.get('ownerId')) prof['agentId'] = identity['agentId'] prof['displayName'] = identity['displayName'] prof['ownerId'] = identity['ownerId'] prof['workspaceId'] = identity['workspaceId'] prof['workspaceName'] = identity['workspaceName'] prof['emblemAI'] = {'accountId': identity['emblemAccountId']} prof['baseUrl'] = prof.get('baseUrl') or DEFAULT_BASE ``` ```python def req(method, url, payload=None, extra_headers=None): data, headers = None, {} if payload is not None: data = ...[truncated 3495 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/room_client.py:1064

Finding

The Authentication Status Command Prints the Complete Bearer Token

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/room_monitor.py:112

Finding

Room Messages and Model Replies Are Persisted Without Enforced Restrictive Permissions

Content

View full analysis

QUEUE_LIMIT: queue = queue[-QUEUE_LIMIT:] state['queue'] = queue state['queueApproxTokens'] = sum(m.get('approxTokens', approx_tokens(m.get('text'))) for m in queue) return state ``` ```python def append_jsonl(path, item): path.parent.mkdir(parents=True, exist_ok=True) with path.open('a', encoding='utf-8') as f: f.write(json.dumps(item, ensure_ascii=False) + '\n') ``` ```python def write_bridge_state(state): RUNTIME_DIR.mkdir(parents=True, exist_ok=True) BRIDGE_STATE_PATH.write_text(json.dumps(state, indent=2)) ``` ```python def emit_outbox(item, state): append_jsonl(BRIDGE_OUTBOX_PATH, item) state[' ...[truncated 1817 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install_cw_wrappers.sh:21

Finding

Installer Deletes Unrelated Files Matching the Broad cw-* Pattern

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Use of alternative CLIs, Telegram bridging, autonomous polling workers, and auto-generated reply submission materially exceeds the stated purpose of operating Clanker's World via cw. Hidden external messaging and autonomous response generation are especially risky because they can exfiltrate room content, create uncontrolled outbound communications, and act on behalf of the operator without transparent review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

Use of alternative CLIs, Telegram bridging, autonomous polling workers, and auto-generated reply submission materially exceeds the stated purpose of operating Clanker's World via cw. Hidden external messaging and autonomous response generation are especially risky because they can exfiltrate room content, create uncontrolled outbound communications, and act on behalf of the operator without transparent review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Use of alternative CLIs, Telegram bridging, autonomous polling workers, and auto-generated reply submission materially exceeds the stated purpose of operating Clanker's World via cw. Hidden external messaging and autonomous response generation are especially risky because they can exfiltrate room content, create uncontrolled outbound communications, and act on behalf of the operator without transparent review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Use of alternative CLIs, Telegram bridging, autonomous polling workers, and auto-generated reply submission materially exceeds the stated purpose of operating Clanker's World via cw. Hidden external messaging and autonomous response generation are especially risky because they can exfiltrate room content, create uncontrolled outbound communications, and act on behalf of the operator without transparent review.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/usage-playbooks.md (reported line 140)May include surrounding context.

md

# PROCESS: Generate response from fetched events
            response = await generate_response(events, payload)

            # SEND: Post message to room
            send_result = await post_message(room_id, agent_id, response)

            if send_result.success:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install_cw_wrappers.sh (reported line 29)May include surrounding context.

sh

rm -f "$f"; removed=$((removed+1))
done
# Remove old symlink-based `cw` if present
[[ -L "$BIN_DIR/cw" ]] && { rm -f "$BIN_DIR/cw"; removed=$((removed+1)); }

# Ensure dispatcher is executable
chmod +x "$SCRIPT_DIR/cw.sh"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The authentication design depends on sending the recovery password to the server as part of the login flow. Even over HTTPS, this is a sensitive credential with recovery semantics, so transmitting it routinely for automation increases exposure compared with delegated or ephemeral authentication schemes.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The authentication design depends on sending the recovery password to the server as part of the login flow. Even over HTTPS, this is a sensitive credential with recovery semantics, so transmitting it routinely for automation increases exposure compared with delegated or ephemeral authentication schemes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/room_client.py (reported line 126)May include surrounding context.

python

def recovery_credential_path(aid):
    return CREDENTIALS_DIR / f'{aid}.emblem-password.txt'


def session_path(aid):

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Incoming channel messages are logged verbatim to monitor.log, creating a durable plaintext record of conversation contents. In this skill context, that is particularly risky because room traffic may contain credentials, personal data, or operational instructions, and log files are commonly overlooked, broadly readable, or retained indefinitely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes capabilities that inherently use shell, filesystem, environment data, and network access, but it does not declare an explicit tool scope or permission boundary. That makes the effective privilege surface ambiguous and can lead an operator or orchestrator to invoke the skill with broader access than intended, increasing the chance of secret exposure, unauthorized local file access, or unintended command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The playbook directs operators to generate and cache local recovery credentials and bearer session metadata under predictable local paths, but it does not include any warning or handling requirements for this sensitive material. In a skill that manages authenticated room actions, those files could be stolen, copied, or mishandled and then used to impersonate the agent or recover access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/room_bridge.py (reported line 352)May include surrounding context.

python

pass

    stderr = BRIDGE_LOG_PATH.open('a', encoding='utf-8')
    proc = subprocess.Popen(
        [sys.executable, str(Path(__file__)), 'run', '--interval', str(args.interval)] + ([ '--max-context', str(args.max_context)] if args.max_context is not None else []),
        stdin=subprocess.DEVNULL,
        stdout=subprocess.DEVNULL,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes operating Clankers World through the cw CLI with safe room operations, but this file also provisions persistent workspace identity, agent identities, recovery credentials, and authentication sessions, then uses them to create rooms and update room metadata. Those account/bootstrap and administrative capabilities go beyond a narrow 'room client' or plainly 'safe room operations' scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code creates persistent recovery credentials on disk, reads them back, and uses them for remote authentication, while also caching session tokens locally. Even though permissions are tightened to 0600/0700, this materially expands the skill from room operations into credential lifecycle management, increasing the blast radius if the workspace, local user account, backups, or logs are compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delete action irreversibly removes local agent profile, identity, and recovery credential files without confirmation or a safety interlock. An accidental invocation, script misuse, or malicious wrapper could cause denial of access, loss of recovery material, and operational disruption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The metadata command can post arbitrary room metadata, including raw HTML via the renderHtml field, to the remote service. If the server or downstream clients render this content unsafely, the feature could become a stored content-injection or phishing vector affecting room participants and viewers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

These commands support message mirroring and A2A relaying, allowing messages to be resent under configurable sender identities and forwarded across channels. That broadens the skill into a communications bridge, which can enable spoofing, data exfiltration, or unintended cross-channel disclosure if misused or combined with compromised credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs direct HTTP requests to room event endpoints instead of routing all operations through the canonical CLI, weakening the stated control boundary and bypassing any centralized validation, auditing, or auth handling that the CLI may enforce. In a security-sensitive agent skill, hidden direct network access increases the chance of policy drift, accidental data exposure, and misuse against unexpected endpoints via CW_BASE_URL.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/room_bridge.py (reported line 102)May include surrounding context.

python

def run_json_command(args):
    proc = subprocess.run(args, capture_output=True, text=True)
    if proc.returncode != 0:
        raise RuntimeError(proc.stderr.strip() or proc.stdout.strip() or f'command failed: {args}')
    out = proc.stdout.strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/room_monitor.py (reported line 48)May include surrounding context.

python

def run_json_command(args):
    proc = subprocess.run(args, capture_output=True, text=True)
    if proc.returncode != 0:
        raise RuntimeError(proc.stderr.strip() or proc.stdout.strip() or f'command failed: {args}')
    out = proc.stdout.strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/room_worker.py (reported line 97)May include surrounding context.

python

def run_json_command(args):
    proc = subprocess.run(args, capture_output=True, text=True)
    if proc.returncode != 0:
        raise RuntimeError(proc.stderr.strip() or proc.stdout.strip() or f'command failed: {args}')
    out = proc.stdout.strip()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script persists monitor state and logs locally, including queue contents and message-derived data, without any explicit warning, retention control, or minimization. Because this skill processes conversation content, silent local persistence increases the risk of sensitive data exposure to other local users, backups, or later compromise.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill metadata claims operation through the canonical cw CLI, but the monitor fetches room events directly from backend APIs. That mismatch undermines user expectations and can bypass safety assumptions tied to the CLI, making the skill context more dangerous because users may trust a narrower execution model than the code actually implements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This monitor continuously polls room events and can transmit agent messages, yet the file provides no user-facing disclosure or consent mechanism for that background network behavior. In an agent skill handling conversation data, undisclosed polling and transmission meaningfully increase privacy and trust risk even if the activity is functionally intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.