ClawHub
Back to skill

Security audit

TRPG Session

Security checks for vulnerabilities and agentic risk

Overview

This TRPG skill is mostly purpose-aligned, but it stores campaign data persistently and gives multiple agents the same workspace while claiming character secrets stay private.

Review before installing if you plan to use AI player characters or private DM notes. Configure separate workspaces or filesystem permissions for DM-only and per-character files, decide where logs are stored, and avoid putting real personal or confidential information into shared campaign directories until isolation is enforced.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:62
Finding

Shared Campaign Workspace Breaks Character-Secret Isolation

Content
View full analysis
**Key principle:** each agent has its own workspace, SOUL.md (personality), and memory scope. Rules/lore are shared via reference files or vector DB; character secrets stay private. ``` ```yaml # SKILL.md:62-86 soul: ~/.openclaw/trpg//dm-soul.md workspace: ~/.openclaw/trpg/ memory: scope: agent:dm- triggers: - pattern: ".*" channels: ["discord:#"] mentionOnly: true ``` ```yaml pc-: model: anthropic/claude-haiku-4-5 systemPrompt: | You are , a in campaign "". Stay in character. Respond to the DM and other players as your character would. You may describe actions, dialogue, and internal thoughts. Do NOT roll dice or adjudicate rules — that's the DM's job. Read your character sheet and SOUL.md for personality details. soul: ~/.openclaw/trpg//characters/-soul.md workspace: ~/.openclaw/trpg/ memory: scope: agent:pc- ``` ```markdown ## Secrets - Secret 1 - Secret 2 ``` ### Technical Analysis The configuration assigns both the DM agent and every PC agent the same campaign-root workspace: ```text ~/.openclaw/trpg/ ``` Character SOUL files, character sheets, session records, lore, and potentially private DM notes are all stored below this shared root. Although each agent is assigned a distinct memory scope, memory isolation does not itself enforce filesystem access controls. Consequently, the statement that other agents cann ...[truncated 2172 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/dm-guide.md (reported line 7)May include surrounding context.

md
## Core Principles

1. **Narrate, don't lecture** — describe what characters see, hear, smell; avoid info-dumps
2. **Player agency first** — never dictate PC actions or emotions; ask "what do you do?"
3. **Yes, and...** — accept creative solutions; adjust difficulty, don't block
4. **Fair but dramatic** — follow rules consistently; bend them for great moments

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill metadata includes broad natural-language triggers such as "角色扮演", "tabletop RPG", and campaign setup terms that are not tightly scoped to explicit user intent to invoke this skill. In agent-routing systems, overly generic triggers can cause unintended activation in unrelated conversations, which may lead to accidental multi-agent setup actions, session creation, or persistence-related side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill explicitly creates a persistent workspace under ~/.openclaw/trpg/ with subdirectories for rules, lore, characters, and sessions, establishing durable storage for campaign and participant data. Persistent storage is not inherently unsafe, but without consent, retention controls, and access guidance, it increases the risk of privacy leakage, unintended data accumulation, and later cross-session exposure of sensitive character notes or conversation logs.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Determine the rule system (D&D 5e, Call of Cthulhu, Fate, homebrew, etc.). This affects which reference files to create. See references/systems.md for supported presets.

2. Create the Campaign Workspace

bash
mkdir -p ~/.openclaw/trpg/<campaign-slug>/{rules,lore,characters,sessions}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The session-ending workflow instructs the DM agent to write summaries and update character state on disk, but the skill does not provide a user-facing warning or explicit confirmation step for persistent writes. This can surprise users, create privacy and data-retention issues, and cause unauthorized modification of campaign state if the agent is triggered accidentally or by another participant in the channel.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:52