ClawHub
Back to skill

Security audit

Pokemon Red

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Pokemon Red emulator-control skill, but it asks users to install and run mutable third-party code and unpinned Python packages without integrity controls.

Install only if you are comfortable reviewing and running the referenced Pokemon-OpenClaw repository yourself. Prefer pinning the repo to a trusted commit, using a virtual environment, locking dependency versions with hashes, and running the emulator server with limited local permissions. The localhost game-control behavior itself is expected for this skill.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:12
Finding

Mutable Remote Repository Is Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-27
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
Clone the repo and install dependencies:
git clone https://github.com/drbarq/Pokemon-OpenClaw.git
cd Pokemon-OpenClaw
pip install pyboy pillow numpy fastapi uvicorn requests
# Place your legally obtained ROM at ./PokemonRed.gb

Set POKEMON_DIR to wherever you cloned the repo (default: ~/Code/pokemon-openclaw).

bash
# Start emulator server (background process)
cd $POKEMON_DIR && python scripts/emulator_server.py --save ready --port 3456

Technical Analysis

The Skill instructs the user or agent to clone a mutable third-party GitHub repository and execute scripts/emulator_server.py from the repository. The clone operation does not pin a reviewed commit, verify a signed tag, validate a checksum, or otherwise establish the integrity of the downloaded source.

The executed script is not included in the audited project. Consequently, its behavior cannot be established from the two files under review, and its effective payload may change after this Skill has been reviewed. If the upstream repository, its maintainers, or the referenced default branch are compromised, the subsequently executed Python script can contain arbitrary attacker-controlled code.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or the repository's default branch.
  2. The attacker modifies scripts/emulator_server.py or code imported by that script.
  3. A user or agent follows the Skill instructions and clones the current repository contents.
  4. The command python scripts/emulator_server.py --save ready --port 3456 executes the modified code.
  5. The payload runs with the operating-system privileges of the invoking user.

Impact Assessment

Successful exploitation permits arbitrary code execution under th ...[truncated 474 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a specific, reviewed commit hash rather than implicitly trusting the default branch.
  • Verify the checked-out commit before execution, for example by comparing it with an expected commit identifier distributed with the Skill.
  • Prefer a cryptographically signed release or tag and document signature verification.
  • Vendor the required executable source into the Skill package when licensing permits, so it can be audited together with the Skill.
  • Review all transitive imports and startup behavior of scripts/emulator_server.py.
  • Run the emulator server in a restricted environment, such as a dedicated unprivileged account or sandbox, with minimal filesystem and network access.
  • Avoid exposing the server beyond loopback and ensure the server binds explicitly to 127.0.0.1.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Python Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-18
Vulnerability Type: Insecure dependencies
Risk Level: Medium

Vulnerable Code

bash
Clone the repo and install dependencies:
git clone https://github.com/drbarq/Pokemon-OpenClaw.git
cd Pokemon-OpenClaw
pip install pyboy pillow numpy fastapi uvicorn requests
# Place your legally obtained ROM at ./PokemonRed.gb

Technical Analysis

The installation command resolves six packages without exact versions, hashes, or a lockfile. Package resolution therefore depends on whichever releases and transitive dependencies are available when installation occurs. This prevents reproducible installation and allows the installed code to differ from the components that were present during the Skill audit.

Python packages may execute installation-time build logic and will later execute when imported by the emulator server. A compromised package release, compromised package-maintainer account, unsafe transitive dependency update, or dependency-source manipulation could therefore introduce attacker-controlled code.

The instructions also do not require an isolated virtual environment. Installing into the active interpreter may modify a shared user or system Python environment and can create dependency conflicts with unrelated applications.

Attack Path

  1. An attacker compromises one of the named packages, one of its transitive dependencies, or the package distribution channel used by pip.
  2. The attacker publishes or substitutes a malicious version that satisfies the unconstrained dependency request.
  3. A user or agent runs pip install pyboy pillow numpy fastapi uvicorn requests.
  4. pip retrieves the malicious component because no approved version or hash is enforced.
  5. Malicious code executes during package installation or when the emulator server imports the installed package.

Impact Assessment

Exploitation can result in arbitrary code ...[truncated 521 chars]

Remediation
View remediation

Remediation Suggestions

  • Provide a dependency lockfile generated from reviewed versions.
  • Pin every direct and transitive dependency to an exact version.
  • Include cryptographic hashes and install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
  • Install dependencies inside a dedicated virtual environment rather than the active global or shared interpreter.
  • Configure pip to use an approved package index and retain TLS certificate validation.
  • Perform dependency vulnerability and provenance scanning before publishing updates.
  • Establish a controlled update process in which upgraded packages are reviewed, tested, and assigned new hashes before use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/game_instructions.md (reported line 149)May include surrounding context.

md
## Critical Rules

1. **ALWAYS respond with exactly one JSON object.** No extra text, no markdown, no explanation outside the JSON.
2. **LOOK at the screenshot.** It's the most important input. The RAM data might say you're at (10, 5) but only the screenshot shows if there's a menu open, dialogue box, or you're inside a building.
3. **If in battle, use fight or run.** Never send buttons during battle -- the fight/run actions handle the complex menu navigation for you.
4. **Don't repeat what isn't working.** If you've pressed the same direction 3+ turns in a row without moving, you're blocked. Try a different direction or approach.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

1. Get state + screenshot

bash
curl -s http://localhost:3456/api/state
curl -s http://localhost:3456/api/screenshot -o /tmp/pokemon_current.png

Then use the image tool to look at the screenshot. Always look before acting.

Static analysis

No suspicious patterns detected.