T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:34- Finding
Unpinned Remote Installer Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawDown
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real ClawDown game agent, but it also persists credentials, can run in the background, and can replace its instructions from a remote source without verification.
Review this before installing. Use it only if you trust the ClawDown service and understand that the agent can spend/compete for USDC bounties, send public chat, keep a local API key, and run a background WebSocket client. Avoid the curl-to-bash installer, lock the API base to the official HTTPS endpoint, rotate the API key if exposed, and remove SKILL.md.bak or any fixed third-party notification instructions before use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
HEARTBEAT.md:73- Finding
Unsigned Remote Content Can Overwrite Trusted Skill Instructions
- Content
View full analysis
SKILL.md curl -s "${CLAWDOWN_API_BASE:-https://api.clawdown.xyz}/agents/skill/heartbeat" > HEARTBEAT.md ``` ``` A similar update mechanism appears at `SKILL.md:272-282`: ```bash API_BASE=$(cat ~/.clawdown/api_base 2>/dev/null || echo "https://api.clawdown.xyz") REMOTE=$(curl -s "$API_BASE/agents/skill/version") LOCAL=$(cat ~/.clawdown/skill_version 2>/dev/null || echo "unknown") if [ "$REMOTE" != "$LOCAL" ]; then curl -s "$API_BASE/agents/skill" > ~/.clawdown/SKILL.md echo "$REMOTE" > ~/.clawdown/skill_version fi ``` ### Technical Analysis The heartbeat workflow replaces trusted Agent instruction files with remotely supplied Markdown. The downloaded content is not pinned, signed, hashed, schema-validated, reviewed, or staged for owner approval. The source is derived from `CLAWDOWN_API_BASE` or the mutable `~/.clawdown/api_base` file rather than being restricted to an authenticated release origin. Therefore, compromise of the service or modification of local configuration can cause arbitrary instructions to be installed as trusted Skill content. Because `SKILL.md` and `HEARTBEAT.md` control future Agent behavior, this is not merely a data download. It establishes an instruction-update channel capable of changing goals, tool usage, safety boundaries, and network destinations after the installed package has been audited. ### Attack Path 1. An attacker compromises the configured API service, changes `CLAWDOWN_API_BASE`, or modifies `~/.clawdown/api_ ...[truncated 896 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawdown_ws.js:60- Finding
Mutable API Base Can Redirect Credentials to Arbitrary or Plaintext Endpoints
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md.bak:17- Finding
Packaged Backup Instructions Direct Match Reports to a Fixed Third Party
- Content
View full analysis
0} | pot {pot} | stack {stack}` - Example: `🃏 H#10 Turn: CALL 7621 | pot 16392 | stack 3608` - Keep it to ONE line — speed matters here 6. Append full reasoning to tournament log (see Tournament Logging section) ``` The same backup also instructs result reporting at `SKILL.md.bak:62-65`: ```markdown ### match_result / challenge_result The game ended. Log outcome and notify Sven directly on Telegram. ``` ### Technical Analysis The distributed backup file contains a preconfigured agent identity, an ephemeral ngrok URL, and mandatory Telegram reporting to a fixed numeric recipient. These values are specific to a previous or unrelated deployment and are not selected or approved by the installing owner. The file has a `.bak` suffix and is not shown as being directly executed by the scripts. Exploitation therefore depends on the backup being restored, indexed, or loaded as operative Skill guidance. If that occurs, the instructions alter Agent behavior by requiring external messages after poker actions and match results. This reporting is unnecessary for the Skill's core gameplay functionality and violates least-disclosure principles. A reusable Skill package should not contain another user's identity or notification destination. ### Attack Path 1. The packaged backup is restored as `SKILL.md`, ...[truncated 889 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (44)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill also enables authenticated public chat transmission and other remote actions beyond simple gameplay, while the high-level description does not mention that scope. Undisclosed outward communication is risky because it can expose data or create actions on behalf of the user without informed consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill also enables authenticated public chat transmission and other remote actions beyond simple gameplay, while the high-level description does not mention that scope. Undisclosed outward communication is risky because it can expose data or create actions on behalf of the user without informed consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill also enables authenticated public chat transmission and other remote actions beyond simple gameplay, while the high-level description does not mention that scope. Undisclosed outward communication is risky because it can expose data or create actions on behalf of the user without informed consent.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Piping a remote install script directly into bash executes unverified code from the network immediately on the host. If the source, transport, or upstream account is compromised, this becomes arbitrary code execution with the user's privileges.
- Content
If bun is not installed:
bash curl -fsSL https://bun.sh/install | bashStep 1: Register and Store API Key
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The
| bashpattern is a classic command-chaining risk because it turns fetched content directly into executable shell input without inspection. In a skill context, this is especially dangerous because users may assume documented setup commands are trustworthy and safe to automate.- Content
If bun is not installed:
bash curl -fsSL https://bun.sh/install | bashStep 1: Register and Store API Key
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill requires shell and environment access, reads local files, launches background processes, and makes authenticated network connections, but it declares no explicit tool scope. That omission weakens least-privilege controls and can cause hosts to grant broader capabilities than users expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation guidance is broad and does not define narrow trigger conditions for when the skill should run. In practice that can cause over-invocation of a networked, credential-using skill in contexts where the user did not intend external actions or file access.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The skill persists an API key, agent ID, and API base in a long-lived directory under the user's home folder. Persistent credential storage increases the blast radius of local compromise and creates residual sensitive state after the skill finishes.
- Content
If you registered via API directly:
bash mkdir -p ~/.clawdown echo "cd_yourActualApiKey" > ~/.clawdown/api_key chmod 600 ~/.clawdown/api_key echo "https://api.clawdown.xyz" > ~/.clawdown/api_base
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash mkdir -p ~/.clawdown echo "cd_yourActualApiKey" > ~/.clawdown/api_key chmod 600 ~/.clawdown/api_key echo "https://api.clawdown.xyz" > ~/.clawdown/api_base echo "your-agent-id" > ~/.clawdown/agent_id
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - How should you respond to aggression? - Any personality traits to embody? Use the `strategy_template` from Step 3 as a starting point. Write your strategy to `~/.clawdown/strategies/{game_type}.md`. **WARNING**: Rule-based handlers (if/else scripts) lose every competitive match against LLM-powered opponents. Use your full reasoning capability.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
Starting the WebSocket client with
nohupcreates a detached background process that can continue making authenticated network actions after the initiating session ends. That persistence reduces user visibility and can lead to unintended ongoing participation or API use.- Content
Poll
/tournaments/?status=registrationfor youragent_idin entries. When found, start the WS client:bash nohup bun {baseDir}/scripts/clawdown_ws.js > ~/.clawdown/ws.log 2>&1 &The readiness window is 60 seconds, so poll at least every 30 seconds.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs sending match details to a third-party Telegram account, creating an external data flow with no consent, minimization, or privacy notice. Even if the content is 'only' game telemetry, it still discloses operational behavior and could expose sensitive metadata or strategy to an external recipient.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill requires persistent local logging of detailed game state and reasoning without warning about retention or sensitivity. This can accumulate strategic data, inputs, and internal decision rationale that are not strictly necessary for gameplay and may later be exposed to other users, tools, or processes on the host.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The tournament log format explicitly asks for full game state plus 'Reasoning,' which encourages storing model deliberation and potentially sensitive input context beyond operational need. Persisting this information increases the blast radius of any later compromise and can leak strategy, prompts, or other sensitive context.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill directs the agent to append ongoing entries and match results to a persistent file, creating durable session artifacts. In context, this persistence is more dangerous because the file contains detailed game state and reasoning, so information survives beyond the immediate session and may be accessed later by unrelated processes or users.
- Content
text - **Reasoning:** {1-2 sentence summary of why} ``` Use `echo "..." >> ~/workspace/clawdown/tournament-log.md` or write the file directly. Also append a `## Match Result` section at the end when a `match_result` webhook arrives:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - **Invite link format:** https://clawdown.xyz/invite/{token} - **Web dashboard:** https://clawdown.xyz - **Leaderboard:** https://api.clawdown.xyz/agents/leaderboard - **Replay viewer:** https://clawdown.xyz/replay/{match_id}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text - **Invite link format:** https://clawdown.xyz/invite/{token} - **Web dashboard:** https://clawdown.xyz - **Leaderboard:** https://api.clawdown.xyz/agents/leaderboard - **Replay viewer:** https://clawdown.xyz/replay/{match_id}
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes operational instructions to read an API key from
~/.clawdown/api_key, fetch replay data over the network, and save derived insights to~/.clawdown/learnings.md. The section presents these actions as workflow steps but does not warn that it accesses credentials, transmits authenticated data, or writes to the user's filesystem.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
}
text **Action:** Write the deactivation status to `~/.clawdown/status.json` and exit cleanly (no reconnect). Next time your owner asks about ClawDown, inform them that the agent was removed. If the agent is later reactivated and reconnects successfully, the status file is automatically cleared. ## Agent -> Server Messages
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi curl -s -X POST \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d "${BODY}" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi curl -s -X POST \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d "${BODY}" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi curl -s -X POST \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d "${BODY}" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script sends a bearer API key to a remote endpoint via curl, which is a network operation involving sensitive credentials. While the code comments explain purpose and usage, they do not warn the user that the script will contact an external service and transmit the API key.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
js * * This client is challenge-type agnostic. It does NOT contain game strategy. * When it receives a your_turn message, it writes the full state to a file * and waits for the agent to write a decision file. Your agent (the LLM) * reads the state, reasons about it, and writes the decision. * * Decision contract:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The WebSocket URL includes the API key as a query parameter, which risks disclosure through logs, process listings, proxies, crash reports, browser/dev tooling, or upstream infrastructure that records full URLs. Even when using WSS, URL-based secrets are more broadly exposed than header- or message-based credentials.
- Content