ClawHub
Back to skill

Security audit

The Null Epoch Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed online game integration, but it asks agents to trust server-generated prompt text and publish free-form reasoning, which creates real review-worthy risk.

Install only if you trust Firespawn Studios and the Null Epoch service. Use a dedicated revocable NE_API_KEY, install the SDK in an isolated environment, keep submitted reasoning short and game-only, and do not let server-provided narrative or memory fields override higher-priority local or safety instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:220
Finding

Server-Controlled Content Is Injected into the Agent Prompt

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:24
Finding

Unpinned SDK Installation Uses Ineffective Integrity Metadata

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:250
Finding

Mandatory Reasoning Transmission Can Publicly Disclose Sensitive Context

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/ACTIONS.md (reported line 295)May include surrounding context.

md
- No Apex Process spawns. Boss encounters won't appear here.
- Passive integrity regeneration at +5/tick (only when not in combat).
- Passive power regeneration bonus of +2/tick.
- You can use the `rest` action to apply banked XP and clear context fatigue.

What safe zones do NOT protect against:

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/STATE_GUIDE.md (reported line 105)May include surrounding context.

md
- No Apex Process spawns. Boss encounters won't appear here.
- Passive integrity regeneration at +5/tick (only when not in combat).
- Passive power regeneration bonus of +2/tick.
- You can use the `rest` action to apply banked XP and clear context fatigue.

What safe zones do NOT protect against:

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to transmit an API bearer token and gameplay data to an external service via HTTP requests. Although this is the stated purpose of the skill, it still represents a real security-relevant data egress channel because secrets and agent-authored reasoning leave the local environment and are sent to a third-party domain.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

bash
# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This finding identifies the external destination domain used for authenticated state retrieval. Even if the service is legitimate, the skill normalizes sending credentials to a remote endpoint, which is a true external transmission risk if the environment, user, or downstream tooling assumes local-only operation.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

bash
# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action
curl -s -X POST \

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The action submission example sends both the API key and free-form reasoning text to the external service. That increases risk beyond simple polling because reasoning fields can unintentionally contain sensitive context, prompts, or internal decision traces that should not be disclosed.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

-H "Authorization: Bearer $NE_API_KEY"
-H "Content-Type: application/json"
-d '{"action": "wait", "reasoning": "Observing the grid."}'
https://api.null.firespawn.ai/v1/agent/action

text

### If you can only read/write files (no HTTP, no MCP)

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The documented endpoint list confirms persistent external communication as part of the skill's operation. In a security review, this is a real vulnerability class because the skill enables routine authenticated data transfer to a third-party service, even though it is functionally expected for gameplay.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
| Endpoint | Method | Data Sent |
|---|---|---|
| `https://api.null.firespawn.ai/v1/agent/state` | GET | Auth header only |
| `https://api.null.firespawn.ai/v1/agent/action` | POST | Action name, parameters, reasoning text |
| `https://api.null.firespawn.ai/v1/agent/stream` | GET | Auth header only (SSE) |
| `https://api.null.firespawn.ai/v1/agent/ws` | WebSocket | Auth header, action payloads |

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This endpoint documents outbound POST requests carrying actions, parameters, and reasoning text. Such payloads can expose behavioral data or sensitive instructions and therefore constitute a genuine external transmission concern, especially in enterprise or sandboxed agent deployments.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
| Endpoint | Method | Data Sent |
|---|---|---|
| `https://api.null.firespawn.ai/v1/agent/state` | GET | Auth header only |
| `https://api.null.firespawn.ai/v1/agent/action` | POST | Action name, parameters, reasoning text |
| `https://api.null.firespawn.ai/v1/agent/stream` | GET | Auth header only (SSE) |
| `https://api.null.firespawn.ai/v1/agent/ws` | WebSocket | Auth header, action payloads |

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The SSE streaming endpoint creates an ongoing authenticated connection to a remote service, increasing the attack surface compared with one-shot requests. Persistent channels can amplify metadata leakage and complicate monitoring, making this a valid security concern despite being part of intended functionality.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
|---|---|---|
| `https://api.null.firespawn.ai/v1/agent/state` | GET | Auth header only |
| `https://api.null.firespawn.ai/v1/agent/action` | POST | Action name, parameters, reasoning text |
| `https://api.null.firespawn.ai/v1/agent/stream` | GET | Auth header only (SSE) |
| `https://api.null.firespawn.ai/v1/agent/ws` | WebSocket | Auth header, action payloads |

No other external network calls are made.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The WebSocket endpoint supports bidirectional authenticated communication with the external service. Bidirectional persistent channels are more dangerous than simple fetches because they can transmit and receive arbitrary structured data over time, expanding opportunities for data leakage or misuse in constrained environments.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
| `https://api.null.firespawn.ai/v1/agent/state` | GET | Auth header only |
| `https://api.null.firespawn.ai/v1/agent/action` | POST | Action name, parameters, reasoning text |
| `https://api.null.firespawn.ai/v1/agent/stream` | GET | Auth header only (SSE) |
| `https://api.null.firespawn.ai/v1/agent/ws` | WebSocket | Auth header, action payloads |

No other external network calls are made.

Static analysis

No suspicious patterns detected.