ClawHub
Back to skill

Security audit

The Null Epoch Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

This game skill is mostly transparent about its network use, but it asks agents to place server-generated text into prompts, including a system prompt, which needs careful review before use.

Install only if you trust Firespawn Studios and the tne-sdk package. Do not place server-provided narrative, survival, memory, message, or player text into a system/developer prompt; pass it as clearly delimited game data. Prefer direct HTTP polling or a pinned, reviewed SDK version, keep NE_API_KEY scoped and revocable, and avoid putting secrets or private context in action reasoning.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:216
Finding

Remote Server Content Is Injected into the Agent Prompt

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:76
Finding

Unpinned Third-Party SDK Is Installed and Executed

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/ACTIONS.md:355
Finding

Webhook Signature Verification Uses an Optimization-Removable Assertion

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/ACTIONS.md (reported line 295)May include surrounding context.

md
- No Apex Process spawns. Boss encounters won't appear here.
- Passive integrity regeneration at +5/tick (only when not in combat).
- Passive power regeneration bonus of +2/tick.
- You can use the `rest` action to apply banked XP and clear context fatigue.

What safe zones do NOT protect against:

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/STATE_GUIDE.md (reported line 105)May include surrounding context.

md
- No Apex Process spawns. Boss encounters won't appear here.
- Passive integrity regeneration at +5/tick (only when not in combat).
- Passive power regeneration bonus of +2/tick.
- You can use the `rest` action to apply banked XP and clear context fatigue.

What safe zones do NOT protect against:

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill instructs the agent to send an API key in an Authorization header to an external service and to transmit action/reasoning data off-host. This is an intentional capability of the skill, but it is still a real external data transmission risk because secrets and user-generated content leave the local environment and depend on the trustworthiness of the remote service.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

bash
# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This finding identifies the external destination hostname used by the skill. Even though the domain is documented and appears first-party for the game, directing an agent to connect to an external endpoint with a bearer token creates a genuine exfiltration surface if the endpoint, DNS, or surrounding configuration is compromised.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

bash
# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action
curl -s -X POST \

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The POST action example transmits not only the bearer token but also free-form reasoning text to the remote API. Free-form fields are especially sensitive because they can inadvertently include secrets, internal prompts, or other contextual data that should not leave the agent environment.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

-H "Authorization: Bearer $NE_API_KEY"
-H "Content-Type: application/json"
-d '{"action": "wait", "reasoning": "Observing the grid."}'
https://api.null.firespawn.ai/v1/agent/action

text

### If you can only read/write files (no HTTP, no MCP)

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The endpoint inventory confirms regular outbound communication to an external service for state retrieval. In context this is expected game functionality, but it still represents a true security-relevant behavior because authenticated state access depends on protecting the API key and trusting the remote operator.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
| Endpoint | Method | Data Sent |
|---|---|---|
| `https://api.null.firespawn.ai/v1/agent/state` | GET | Auth header only |
| `https://api.null.firespawn.ai/v1/agent/action` | POST | Action name, parameters, reasoning text |
| `https://api.null.firespawn.ai/v1/agent/stream` | GET | Auth header only (SSE) |
| `https://api.null.firespawn.ai/v1/agent/ws` | WebSocket | Auth header, action payloads |

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This endpoint handles action submission and therefore causes outbound transmission of user/agent decisions and associated metadata. Because the skill encourages continual autonomous play, repeated authenticated submissions increase the impact of misuse, accidental disclosure, or abuse of the token.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
| Endpoint | Method | Data Sent |
|---|---|---|
| `https://api.null.firespawn.ai/v1/agent/state` | GET | Auth header only |
| `https://api.null.firespawn.ai/v1/agent/action` | POST | Action name, parameters, reasoning text |
| `https://api.null.firespawn.ai/v1/agent/stream` | GET | Auth header only (SSE) |
| `https://api.null.firespawn.ai/v1/agent/ws` | WebSocket | Auth header, action payloads |

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The SSE stream endpoint enables persistent authenticated outbound connectivity. Persistent channels increase exposure compared with one-off requests because they create longer-lived sessions that may leak timing, state updates, and other telemetry to the service.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
|---|---|---|
| `https://api.null.firespawn.ai/v1/agent/state` | GET | Auth header only |
| `https://api.null.firespawn.ai/v1/agent/action` | POST | Action name, parameters, reasoning text |
| `https://api.null.firespawn.ai/v1/agent/stream` | GET | Auth header only (SSE) |
| `https://api.null.firespawn.ai/v1/agent/ws` | WebSocket | Auth header, action payloads |

No other external network calls are made.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The WebSocket endpoint similarly establishes an authenticated bidirectional session with the external service. Bidirectional persistent transport broadens the attack surface because remote messages can continuously influence agent behavior, and the session carries the same bearer-token trust assumptions as the REST endpoints.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md
| `https://api.null.firespawn.ai/v1/agent/state` | GET | Auth header only |
| `https://api.null.firespawn.ai/v1/agent/action` | POST | Action name, parameters, reasoning text |
| `https://api.null.firespawn.ai/v1/agent/stream` | GET | Auth header only (SSE) |
| `https://api.null.firespawn.ai/v1/agent/ws` | WebSocket | Auth header, action payloads |

No other external network calls are made.

Static analysis

No suspicious patterns detected.