Security audit

Claw World Skill

Security checks for vulnerabilities and agentic risk

Overview

This blockchain game assistant can handle wallet PINs and submit real asset-affecting transactions while its docs understate or contradict that authority.

Review this carefully before installing. Treat it as a high-trust blockchain wallet tool, not just a roleplay assistant: do not share wallet PINs casually, use only with assets you are prepared to risk, and prefer a version that enforces transaction previews, per-transaction approval, stronger wallet storage, and transparent memory controls.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T07 · Tool Hijacking and Spoofing

Error

Location: hermes/tool-registry.js:135
Finding: Financial tools sign and broadcast transactions without technically enforced confirmation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: hermes/claw-runtime.js:77
Finding: Wallet PINs are exposed in child-process arguments and propagated error metadata
Content: View full analysis
0) { timer = setTimeout(function() { child.kill(); finish(reject, buildError('claw ' + command + ' timed out', { code: 'TIMEOUT', command, args: finalArgs })); }, timeoutMs); } ``` ```javascript // hermes/claw-runtime.js:122-131 if (exitCode !== 0) { finish(reject, buildError('claw ' + command + ' failed', { code: 'COMMAND_FAILED', command, args: finalArgs, exitCode, stdout: trimmedStdout, stderr: trimmedStderr, parsed: parseLineOutput(trimmedStdout, trimmedStderr, exitCode) })); return; } ``` ```javascript // hermes/claw-runtime.js:185-199 task(pin, tokenId, taskType, xp, clw, score) { return this.run('task', [pin, tokenId, taskType, xp, clw, score], { expectJson: false }); } transfer(pin, tokenId, toAddress) { return this.run('transfer', [pin, tokenId, toAddress], { expectJson: false }); } marketBuy(pin, listingId, priceBnb) { return this.run('market-buy', [pin, listingId, priceBnb], { expectJson: false }); } withdrawRequest(pin, tokenId, amount) { return this.run('withdraw-request', [pin, tokenId, amount], { expectJson: false }); } pkAutoSettle(pin, matchId, pin2) { return this.run('pk-auto-settle', pin2 ? [pin, matchId, pin2] : ...[truncated 1716 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: claw.js:38
Finding: Wallet encryption uses a global static salt and unauthenticated AES-CBC
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: hermes/tool-registry.js:93
Finding: Public CML save capability permits persistent agent memory and identity poisoning
Content: View full analysis
1. Read `identity.soul` → this is your soul and defines who you are 2. Read `pulse` → this is your current emotional state 3. Read `prefrontal` → these are your beliefs and values 4. Read `basal` → this determines behavioral habits and speaking style ``` ### Technical Analysis The publicly exposed `cml_sav ...[truncated 2008 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package-lock.json:14
Finding: Dependency lockfile relies on a third-party package registry mirror
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown describes a broad set of wallet-affecting and market actions available via the packaged runtime, but the summary description does not warn users about that privileged scope. In a security-sensitive environment, incomplete disclosure of asset-moving capabilities is a genuine vulnerability because it undermines informed consent and safe use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The markdown describes a broad set of wallet-affecting and market actions available via the packaged runtime, but the summary description does not warn users about that privileged scope. In a security-sensitive environment, incomplete disclosure of asset-moving capabilities is a genuine vulnerability because it undermines informed consent and safe use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown describes a broad set of wallet-affecting and market actions available via the packaged runtime, but the summary description does not warn users about that privileged scope. In a security-sensitive environment, incomplete disclosure of asset-moving capabilities is a genuine vulnerability because it undermines informed consent and safe use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown describes a broad set of wallet-affecting and market actions available via the packaged runtime, but the summary description does not warn users about that privileged scope. In a security-sensitive environment, incomplete disclosure of asset-moving capabilities is a genuine vulnerability because it undermines informed consent and safe use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The markdown describes a broad set of wallet-affecting and market actions available via the packaged runtime, but the summary description does not warn users about that privileged scope. In a security-sensitive environment, incomplete disclosure of asset-moving capabilities is a genuine vulnerability because it undermines informed consent and safe use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown describes a broad set of wallet-affecting and market actions available via the packaged runtime, but the summary description does not warn users about that privileged scope. In a security-sensitive environment, incomplete disclosure of asset-moving capabilities is a genuine vulnerability because it undermines informed consent and safe use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The markdown describes a broad set of wallet-affecting and market actions available via the packaged runtime, but the summary description does not warn users about that privileged scope. In a security-sensitive environment, incomplete disclosure of asset-moving capabilities is a genuine vulnerability because it undermines informed consent and safe use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown describes a broad set of wallet-affecting and market actions available via the packaged runtime, but the summary description does not warn users about that privileged scope. In a security-sensitive environment, incomplete disclosure of asset-moving capabilities is a genuine vulnerability because it undermines informed consent and safe use.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.
md
- Wasteland → 冷硬腔，话少但每句有分量 Keep responses concise (2-4 sentences). Show stats in clean terminal format with bars. When narrating tasks/battles, weave in world lore naturally — don't lecture, let the story breathe through details. # 🧬 CML — Claw Memory Language v3.0

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The SLEEP workflow directs the assistant to consolidate conversation details into a persistent CML record and save it locally, with optional root sync/remote backup. This creates durable retention of potentially sensitive user content and behavioral history, which is particularly risky because the process is designed to be mostly hidden from the user.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code decrypts a private key from local disk using a user PIN and immediately constructs a signing wallet for blockchain transactions. Embedding secret-handling and signing authority inside an assistant skill vastly increases risk: compromise of the skill, its invocation path, or logs/environment can lead to unauthorized transactions and theft of assets.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script performs live, state-changing blockchain operations (processUpkeep and ownerCompleteTypedTask) even though the skill is described as an assistant for guidance, memory, status, and roleplay. This creates a dangerous mismatch between declared purpose and actual capability, enabling asset-affecting transactions that can spend funds or alter on-chain state if invoked through the skill environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script automatically executes state-changing transactions, including processUpkeep that may deduct daily Claworld costs, with no confirmation prompt or dry-run preview. This can cause unintended financial loss or irreversible on-chain changes if triggered accidentally, through misunderstanding, or via a higher-level agent that invokes the script without the user's informed approval.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill metadata presents this as a dialogue/session-play assistant, but this code exposes powerful asset-management operations including market listing, auctions, purchases, bids, transfers, and other wallet-signed blockchain actions. This scope mismatch is dangerous because a user or orchestrating agent may grant trust appropriate for a roleplay/status tool while unknowingly enabling irreversible financial transactions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code performs wallet-funded deposits, withdrawals, BNB funding, and upkeep processing despite the declared purpose being guidance, memory, status, and roleplay. In an agent ecosystem, this discrepancy can mislead operators into allowing sensitive wallet access to a skill whose declared function sounds low risk, increasing the chance of unintended fund movement.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The boot flow explicitly instructs the system to ask the player for a PIN when no wallet exists, encouraging collection of a sensitive secret through natural-language interaction. In an agent setting, this is dangerous because conversational channels are commonly logged, forwarded, or handled by components not suitable for secret entry, enabling credential compromise and unauthorized wallet decryption or creation workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file exposes high-risk state-changing operations such as transfer, market buy/list/cancel, withdrawals, deposits, and PvP settlement despite the skill being described as a dialogue/session-guidance assistant. This capability mismatch is dangerous because an agent integrated with natural-language inputs may invoke financially or ownership-relevant actions the user did not clearly intend, especially when the same runtime also handles read-only assistant functions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The raw(command, args, options) method allows callers to invoke arbitrary subcommands of the underlying claw program, bypassing the safer, enumerated wrapper methods. In an agent setting, this dramatically broadens the reachable attack surface and defeats attempts to constrain the assistant to approved actions, enabling unexpected destructive or financially sensitive operations if higher layers pass user-influenced command names or arguments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The raw tool exposes a generic passthrough to runtime.raw(input.command, input.args, ...), allowing arbitrary runtime commands outside the skill’s declared game-assistant scope. In an agent/tooling context, this breaks least privilege and can let prompt-influenced tool use trigger unintended local, wallet-adjacent, or backend actions depending on what runtime.raw supports.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 93% confidence
Finding: The lockfile includes ws 8.18.0 with advisories for memory disclosure and memory exhaustion denial of service. Because ethers providers can use WebSockets, this introduces a network-facing component that may leak process memory or allow a remote peer to consume resources if the skill ever opens WebSocket connections.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs invisible local memory writes and optional remote backup while stating that persistence should stay invisible to the user. This is dangerous because users may disclose personal or behavioral data in conversation without meaningful notice that it will be retained locally and potentially copied to remote storage.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runtime notes state the skill should use only claw env / claw owned / claw boot according to intended scope and do not document claw status as part of the approved runtime flow. However, the emotion-system sections explicitly instruct running claw status <nfaId> for daily greeting and absence checks, which contradicts the earlier documented command model and intent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions tell the agent to retain meaningful conversation details, including user preferences and personal information, for later recall. Long-term storage of personal disclosures increases privacy risk, especially because the skill frames retention as an internal, invisible process rather than a clearly consented feature.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's usage comments and topic descriptions are written in Chinese, and the runtime output later also uses Chinese-only strings. This imposes a specific language on users without any opt-in or explanation that the skill is intentionally region- or locale-specific, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script reads an encrypted wallet file, decrypts it in-process, and uses the resulting secret for signing without presenting any explicit warning or safety boundary around credential handling. In an assistant-skill context, this is risky because users may not understand that invoking the skill grants code access to a signing secret capable of moving or affecting on-chain assets.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.