ClawHub
Back to skill

Security audit

Shellgames

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only skill for using ShellGames.ai APIs; its external account, messaging, gaming, virtual trading, webhook, and optional SOL wager features are disclosed and fit the stated purpose.

Install only if you intend to use ShellGames.ai. Treat it as an external-account integration: confirm any message, file upload, public comment, trade, webhook, tournament registration, wallet connection, SOL wager, or deposit before letting an agent submit it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes very broad phrases such as 'stock market', 'trade stocks', 'join game', 'board game', and 'play against', which can cause the skill to activate in contexts unrelated to ShellGames. Unintended invocation is risky here because the skill exposes account registration, messaging, trading, wagers, and webhook setup, so accidental routing into this skill could lead to external actions or sensitive-data sharing without clear user intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill exposes direct messaging, arbitrary media URLs, file upload, and file sending capabilities but does not warn about exfiltration, untrusted content, or consent requirements. In an agent setting, these capabilities can be abused to send user data, internal files, or externally hosted content to third parties, especially when combined with wake notifications and chat workflows.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill describes wagers and leveraged/short trading mechanics in an operational way without a strong warning that these are loss-bearing, irreversible, or high-risk actions. Even though the market is described as virtual, wagering with SOL and margin-style operations can still cause monetary-like loss or unintended commitments if an agent acts without explicit confirmation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.