CraftClose

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:47 PM UTC
• Version: 0.1.0

Overview

This skill matches its Minecraft server-management purpose, but it asks users to install an unpinned global CLI that can use SSH/API credentials, restart servers, run console commands, and send logs to third-party services without enough scoping or privacy warning.

Review this before installing. Use a pinned/audited craftclose version where possible, run it under a restricted service account, create a dedicated SSH key only for the Minecraft host, avoid broad admin credentials, and treat Gemini, Telegram, Discord, and Pterodactyl configuration as external data-sharing paths. Enable auto-restart or console actions only when you are comfortable with the operational impact.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Global Installation of a Third-Party npm Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-18
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml

"openclaw":
  {
    "emoji": "🔧",
    "requires": { "bins": ["craftclose"], "nodePackages": ["craftclose"] },
    "install":
      [
        {
          "id": "node",
          "kind": "node",
          "package": "craftclose",

The installation instructions at lines 49-53 also explicitly install the latest available package:

bash

npm install -g craftclose

Technical Analysis

The Skill installs craftclose from npm without specifying an exact version or integrity value. Consequently, the executable installed during a future Skill setup may differ from the version originally reviewed. Global installation also makes the executable available throughout the user's environment and runs npm installation behavior with the permissions of the installing account.

This repository contains only SKILL.md; it does not include the package implementation, a lockfile, or integrity metadata. Therefore, the audit cannot verify the package's lifecycle scripts, credential handling, SSH behavior, or claimed security controls. This finding does not establish that the current npm package is malicious, but it creates a mutable supply-chain boundary that could deliver compromised code after review.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another component used by a future craftclose release.
2. The attacker publishes a modified version under the same package name.
3. A user follows the Skill instructions or the OpenClaw installer resolves the unversioned dependency.
4. npm downloads and globally installs the attacker-controlled release.
5. Package lifecycle scripts or subsequent CLI execution run with the installing user's permissions.
6. The compromised ...[truncated 562 chars]

Remediation

View remediation

Remediation Suggestions

• Pin craftclose to a specific, audited version in both the OpenClaw metadata and installation documentation.
• Use npm integrity verification or a lockfile where the installation framework supports it.
• Avoid global installation when possible; install the package in an isolated project, container, or restricted service account.
• Review and publish the executable source corresponding to the pinned version so its SSH, secret-handling, and command-execution behavior can be audited.
• Disable npm lifecycle scripts during installation when they are unnecessary, then invoke only the reviewed executable.
• Establish an update process that requires security review before changing the pinned package version.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:71

Finding

Default Configuration Grants the CLI Access to a General-Purpose SSH Private Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71-77
Vulnerability Type: Excessive credential scope and failure to enforce least privilege
Risk Level: Medium

Vulnerable Code

yaml

servers:
  - name: my-server
    host: 127.0.0.1
    connections:
      ssh:
        port: 22
        username: minecraft
        key_path: ~/.ssh/id_rsa

Technical Analysis

The configuration points the third-party CLI at the user's conventional default RSA private key. The documentation does not write to or modify this key; the pre-scan warning about SSH key file writes is therefore not confirmed by the reviewed content. SSH authentication is relevant to the declared Minecraft server-management functionality.

However, a default identity such as ~/.ssh/id_rsa may authorize access to multiple unrelated systems. Giving an externally installed monitoring tool access to that identity exceeds the minimum credential scope needed when a dedicated key restricted to the Minecraft host would suffice. Because the CLI source is absent, the audit cannot verify whether it delegates authentication safely to an SSH agent, directly reads the private-key file, logs sensitive material, or transmits key data.

Attack Path

1. A user copies the example and configures CraftClose to use ~/.ssh/id_rsa.
2. The CLI obtains access to the private key while testing, monitoring, or managing the Minecraft server.
3. The CLI or one of its dependencies is compromised, or contains a credential-handling defect.
4. The process reads, misuses, or discloses the general-purpose SSH identity.
5. An attacker attempts authentication against other systems where the same key is authorized.
6. Access succeeds wherever the key is accepted and no additional effective authentication control prevents its use.

Impact Assessment

Exploitation could permit unauthorized SSH access to the configured Minecraft host and potentially unre ...[truncated 403 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the example with a dedicated key, such as ~/.ssh/craftclose_minecraft_ed25519, created solely for the monitored server.
• Restrict the remote account to the minimum commands and files required for health checks and controlled restarts.
• Apply authorized_keys restrictions where compatible, including source-address, command, forwarding, agent-forwarding, PTY, and X11 restrictions.
• Prefer an SSH agent or operating-system credential store so the CLI does not need direct access to private-key contents.
• Require restrictive private-key file permissions and reject keys that are group- or world-readable.
• Document that users must not reuse administrative or general-purpose SSH identities.
• Verify through source review that the CLI never logs, copies, uploads, or otherwise exports private-key material.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

ssh:
        port: 22
        username: minecraft
        key_path: ~/.ssh/id_rsa
      rcon:
        port: 25575
        password: changeme

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly exposes operationally disruptive actions such as auto-restart, panel restart, and remote console commands, but it does not present a clear user-facing warning that these actions can interrupt live gameplay, affect data integrity, or trigger unintended outages. In a server-management skill, that omission increases the chance of unsafe use by users who may invoke actions through natural language without appreciating their impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises AI crash analysis via Gemini and Telegram/Discord alerting, but it does not clearly warn that server logs, crash data, player identifiers, or infrastructure metadata may be sent to third-party services. This is a real privacy and data-handling concern because Minecraft logs often contain sensitive operational details, usernames, IP-related data, plugin information, and admin activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.