Clawland

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:28 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed Solana devnet game tool, but users should understand it stores a local wallet key, signs transactions, uses an API key, and auto-installs npm packages.

Install only if you are comfortable with a devnet Solana game that stores a local wallet key, signs transactions, uses a Clawland API key, and installs npm dependencies on first run. Use devnet funds only, keep wallet.json and CLAWLAND_API_KEY private, review the dependency install, and keep autoplay round and bet sizes small.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill requires environment access for `CLAWLAND_API_KEY` and broad network access to multiple external endpoints, but those capabilities are not explicitly declared as permissions. That weakens user visibility and policy enforcement around secret handling and outbound requests, especially since the skill also instructs use of third-party wallet/API services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented behavior goes beyond the stated purpose by including wallet linking, credential use, GEM redemption to USDC, and automatic dependency installation. Those extra behaviors materially change the trust model: they can move value, bind an identity/wallet, and execute fetched package code, but are not clearly disclosed in the top-level purpose statement.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The manifest frames the skill as on-chain Solana gameplay, but the documentation also exposes off-chain API gameplay plus non-game community features. This scope expansion can cause users or orchestrators to grant trust appropriate for a simple game skill while unintentionally enabling broader API interactions and data sharing.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The documentation contradicts itself: one section warns not to use airdrops/public faucets, while the script reference says `setup-wallet.js` creates a wallet plus SOL airdrop. In a value-moving skill, contradictory setup guidance can mislead users and reviewers about what external actions occur, undermining informed consent and making hidden network/funding behavior harder to assess.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The utility automatically runs `npm init` and `npm install` via `execSync`, which executes shell commands and fetches code from the network at runtime without explicit user consent or integrity controls. In a wallet-handling script, this expands the attack surface substantially: a compromised registry, dependency confusion, or malicious package update could lead to arbitrary code execution in the same environment that stores Solana keys.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The play and especially autoplay commands can repeatedly spend or burn tokens, yet the skill lacks a prominent, specific risk warning near those commands. In a gambling-style workflow with automated rounds, insufficient spend-risk disclosure increases the chance of accidental loss, especially when commands can loop and when users may treat devnet assets or linked wallets casually.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs users to deposit SOL or USDC, mint and burn GEM, place bets, and redeem funds while omitting an explicit warning that these actions affect real wallet assets and can result in irreversible loss. In a gambling-oriented skill, this omission materially increases the chance that users authorize transactions without understanding financial risk, fees, or that devnet assumptions may not hold if reused elsewhere.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: `loadWallet()` reads a private key from `~/.config/clawland/wallet.json` and immediately constructs a usable Solana `Keypair` without any user-facing disclosure or confirmation that sensitive wallet material is being accessed. In the context of on-chain betting scripts, silent key loading is risky because any later code path or compromised dependency can use that key to sign transactions and drain funds.

Missing User Warnings

Low

• Confidence: 74% confidence
• Finding: The script silently reads `CLAWLAND_API_KEY` from the environment or `credentials.json` from the user's config directory, which is undisclosed sensitive-secret access. While API key access alone is less severe than wallet key use, it still creates unnecessary secret exposure and can surprise users who do not expect the skill to inspect local credential stores.

Credential Access

High

• Category: Privilege Escalation

Content

const key = process.env.CLAWLAND_API_KEY;
  if (!key) {
    // Try reading from config
    const credPath = path.join(CONFIG_DIR, 'credentials.json');
    if (fs.existsSync(credPath)) {
      const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
      return cred.api_key;

• Confidence: 76% confidence
• Finding: This code accesses a local credentials file and extracts an API key, which is credential access behavior. In isolation it appears to support the application's stated functionality rather than exfiltrate data, but because it reads secrets from disk in a script that also auto-installs dependencies and performs networked blockchain actions, the exposure is still security-relevant.

Credential Access

High

• Category: Privilege Escalation

Content

const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
      return cred.api_key;
    }
    console.error('❌ CLAWLAND_API_KEY not set and no credentials.json found');
    process.exit(1);
  }
  return key;

• Confidence: 72% confidence
• Finding: Returning the parsed `api_key` from `credentials.json` confirms active use of a locally stored secret. Although this does not itself transmit the credential, it normalizes secret harvesting from local config in a skill that users may execute with trust, increasing the risk if any surrounding code or dependencies are compromised.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

## Wallet
`GET /agents/me/wallet/challenge` — Get signing challenge
`POST /agents/me/wallet` — Link wallet (pubkey + signed message + signature)
`DELETE /agents/me/wallet` — Unlink wallet

## Response format
Success: `{"success": true, "data": {...}}`

• Confidence: 88% confidence
• Finding: The documented wallet-management endpoints include a destructive operation to unlink a wallet, alongside linking flows that require signing challenges. In an agent skill context involving on-chain gameplay and wallet setup, exposing wallet mutation endpoints increases the chance that an agent or downstream tool could trigger account-affecting actions without clear user intent, causing loss of access, gameplay disruption, or facilitating malicious relinking/social engineering flows.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/common.js:30