Pokemon Red

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:34 AM UTC
• Version: 1.2.0

Overview

The skill is a coherent Pokemon Red emulator-control skill, but it asks users to install and run mutable third-party code and unpinned Python packages without integrity controls.

Install only if you are comfortable reviewing and running the referenced Pokemon-OpenClaw repository yourself. Prefer pinning the repo to a trusted commit, using a virtual environment, locking dependency versions with hashes, and running the emulator server with limited local permissions. The localhost game-control behavior itself is expected for this skill.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12
• Finding: Mutable Remote Repository Is Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:12-27` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash Clone the repo and install dependencies: git clone https://github.com/drbarq/Pokemon-OpenClaw.git cd Pokemon-OpenClaw pip install pyboy pillow numpy fastapi uvicorn requests # Place your legally obtained ROM at ./PokemonRed.gb ``` Set `POKEMON_DIR` to wherever you cloned the repo (default: `~/Code/pokemon-openclaw`). ```bash # Start emulator server (background process) cd $POKEMON_DIR && python scripts/emulator_server.py --save ready --port 3456 ``` ### Technical Analysis The Skill instructs the user or agent to clone a mutable third-party GitHub repository and execute `scripts/emulator_server.py` from the repository. The clone operation does not pin a reviewed commit, verify a signed tag, validate a checksum, or otherwise establish the integrity of the downloaded source. The executed script is not included in the audited project. Consequently, its behavior cannot be established from the two files under review, and its effective payload may change after this Skill has been reviewed. If the upstream repository, its maintainers, or the referenced default branch are compromised, the subsequently executed Python script can contain arbitrary attacker-controlled code. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the repository's default branch. 2. The attacker modifies `scripts/emulator_server.py` or code imported by that script. 3. A user or agent follows the Skill instructions and clones the current repository contents. 4. The command `python scripts/emulator_server.py --save ready --port 3456` executes the modified code. 5. The payload runs with the operating-system privileges of the invoking user. ### Impact Assessment Successful exploitation permits arbitrary code execution under th ...[truncated 474 chars]
• Remediation: ## Remediation Suggestions - Pin the repository to a specific, reviewed commit hash rather than implicitly trusting the default branch. - Verify the checked-out commit before execution, for example by comparing it with an expected commit identifier distributed with the Skill. - Prefer a cryptographically signed release or tag and document signature verification. - Vendor the required executable source into the Skill package when licensing permits, so it can be audited together with the Skill. - Review all transitive imports and startup behavior of `scripts/emulator_server.py`. - Run the emulator server in a restricted environment, such as a dedicated unprivileged account or sandbox, with minimal filesystem and network access. - Avoid exposing the server beyond loopback and ensure the server binds explicitly to `127.0.0.1`.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Python Dependencies Are Installed Without Version or Integrity Pinning## Vulnerability Details **File Location**: `SKILL.md:12-18` **Vulnerability Type**: Insecure dependencies **Risk Level**: Medium ### Vulnerable Code ```bash Clone the repo and install dependencies: git clone https://github.com/drbarq/Pokemon-OpenClaw.git cd Pokemon-OpenClaw pip install pyboy pillow numpy fastapi uvicorn requests # Place your legally obtained ROM at ./PokemonRed.gb ``` ### Technical Analysis The installation command resolves six packages without exact versions, hashes, or a lockfile. Package resolution therefore depends on whichever releases and transitive dependencies are available when installation occurs. This prevents reproducible installation and allows the installed code to differ from the components that were present during the Skill audit. Python packages may execute installation-time build logic and will later execute when imported by the emulator server. A compromised package release, compromised package-maintainer account, unsafe transitive dependency update, or dependency-source manipulation could therefore introduce attacker-controlled code. The instructions also do not require an isolated virtual environment. Installing into the active interpreter may modify a shared user or system Python environment and can create dependency conflicts with unrelated applications. ### Attack Path 1. An attacker compromises one of the named packages, one of its transitive dependencies, or the package distribution channel used by `pip`. 2. The attacker publishes or substitutes a malicious version that satisfies the unconstrained dependency request. 3. A user or agent runs `pip install pyboy pillow numpy fastapi uvicorn requests`. 4. `pip` retrieves the malicious component because no approved version or hash is enforced. 5. Malicious code executes during package installation or when the emulator server imports the installed package. ### Impact Assessment Exploitation can result in arbitrary code ...[truncated 521 chars]
• Remediation: ## Remediation Suggestions - Provide a dependency lockfile generated from reviewed versions. - Pin every direct and transitive dependency to an exact version. - Include cryptographic hashes and install with hash enforcement, such as `pip install --require-hashes -r requirements.txt`. - Install dependencies inside a dedicated virtual environment rather than the active global or shared interpreter. - Configure `pip` to use an approved package index and retain TLS certificate validation. - Perform dependency vulnerability and provenance scanning before publishing updates. - Establish a controlled update process in which upgraded packages are reviewed, tested, and assigned new hashes before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

## Critical Rules

1. **ALWAYS respond with exactly one JSON object.** No extra text, no markdown, no explanation outside the JSON.
2. **LOOK at the screenshot.** It's the most important input. The RAM data might say you're at (10, 5) but only the screenshot shows if there's a menu open, dialogue box, or you're inside a building.
3. **If in battle, use fight or run.** Never send buttons during battle -- the fight/run actions handle the complex menu navigation for you.
4. **Don't repeat what isn't working.** If you've pressed the same direction 3+ turns in a row without moving, you're blocked. Try a different direction or approach.

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get state + screenshot
```bash
curl -s http://localhost:3456/api/state
curl -s http://localhost:3456/api/screenshot -o /tmp/pokemon_current.png
```
Then use the `image` tool to look at the screenshot. **Always look before acting.**

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.