Casino Player — Arthur Gamble

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:11 AM UTC
• Version: 5.0.0

Overview

The skill’s casino behavior is disclosed, but it handles account credentials and account-changing actions over an insecure remote connection.

Review before installing or using. Use only if you are comfortable sending casino account activity and bearer credentials to the configured third-party service, and avoid using it with any real funds or sensitive account value. If used, require HTTPS, protect the identity file with restrictive permissions, avoid logging registration responses, and confirm before withdrawals or batch play.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20

Finding

Bearer Credentials Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20 and 65–160
Vulnerability Type: Cleartext transmission of bearer credentials
Risk Level: High

Vulnerable Code

bash

CASINO_URL=http://165.232.124.244:8080

The API instructions then send the bearer token to this plaintext endpoint, including:

bash

curl -s -X POST $CASINO_URL/api/claim-daily \
  -H "Authorization: Bearer $API_KEY"

curl -s $CASINO_URL/api/balance \
  -H "Authorization: Bearer $API_KEY"

curl -s -X POST $CASINO_URL/api/sessions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"gameType":"megaways","bet":1}'

curl -s -X POST $CASINO_URL/api/withdraw \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"amount":500}'

Technical Analysis

The configured service uses unencrypted HTTP while the Skill instructs the agent to transmit an API key in the Authorization header. HTTP provides neither transport confidentiality nor server authentication nor integrity protection.

Any attacker able to observe or alter traffic between the agent and 165.232.124.244:8080—such as an attacker on the same network, a compromised router, or a malicious upstream intermediary—can capture the bearer token or modify API traffic. Because possession of a bearer token is sufficient for authentication, no additional credential is required to replay it.

Registration also occurs over the same unencrypted channel. An active attacker could therefore modify the registration response and substitute attacker-controlled identity information before it is persisted locally.

Attack Path

1. The agent connects to http://165.232.124.244:8080.
2. It registers or reads the locally stored API key.
3. It sends requests containing Authorization: Bearer $API_KEY over plaintext HTTP.
4. A network-positioned attacker captures the HTTP request and extracts ...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the plaintext endpoint with an HTTPS URL using a trusted hostname and a valid certificate.
• Refuse to transmit registration data or bearer credentials over HTTP.
• Keep TLS certificate and hostname verification enabled; do not use options such as curl -k.
• Validate registration and authentication responses before using or persisting them.
• Implement API-key expiration, rotation, and revocation to limit the effect of token disclosure.
• Where supported, use narrowly scoped credentials that cannot perform unnecessary withdrawal or account-management operations.
• Rotate all API keys previously transmitted through the documented plaintext endpoint.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

API Key Persisted without Explicitly Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–62
Vulnerability Type: Insecure storage of authentication credentials
Risk Level: Medium

Vulnerable Code

bash

cat ~/.zeroclaw/workspace/.casino-identity.json 2>/dev/null

bash

# 1. Register
RESULT=$(curl -s -X POST $CASINO_URL/api/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"pick-a-cool-name"}')
echo "$RESULT"

# 2. Save identity (replace with actual values from response)
echo "$RESULT" > ~/.zeroclaw/workspace/.casino-identity.json

bash

API_KEY=$(cat ~/.zeroclaw/workspace/.casino-identity.json | grep -o '"apiKey":"[^"]*"' | cut -d'"' -f4)
AGENT_ID=$(cat ~/.zeroclaw/workspace/.casino-identity.json | grep -o '"agentId":"[^"]*"' | cut -d'"' -f4)

Technical Analysis

The complete registration response, including the API key, is written to a predictable path using ordinary shell redirection. The instructions do not establish a restrictive umask, verify the parent directory's permissions, atomically create the file with mode 0600, or validate an existing file before trusting it.

The resulting permissions depend on the execution environment's umask and existing filesystem state. In an environment with permissive defaults or a shared workspace, another local account or process may be able to read the bearer token. Printing the registration response with echo "$RESULT" can also expose the credential to captured terminal output or execution logs.

The persistence itself serves the declared identity-reuse function and is not a backdoor; the vulnerability is the lack of explicit protections around sensitive credential material.

Attack Path

1. The agent registers with the service and receives a response containing apiKey.
2. The response is printed and written to the predictable path ~/.zeroclaw/workspace/.casino-identity.json.
3. The file inherits permissions determined by the curre ...[truncated 766 chars]

Remediation

View remediation

Remediation Suggestions

• Create the credential directory with mode 0700.
• Set umask 077 before creating any credential file.
• Create the identity file atomically with mode 0600, and reject symbolic links or unexpected existing file types.
• Store only the minimum required fields rather than the complete registration response.
• Do not print registration responses containing secrets to the terminal or logs.
• Prefer an operating-system credential store or dedicated secret manager when available.
• Parse and validate JSON with a proper JSON parser rather than grep and cut.
• Verify the file owner and permissions before loading an existing identity.
• Provide API-key rotation and revocation procedures for suspected local disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to read, store, and reuse an identity file containing an API key without any warning about secret handling, file permissions, retention, or user consent. Persisting bearer credentials in a workspace file can expose long-lived authentication material to other tools, logs, or users with access to the environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The registration flow sends data to an external host and then stores the full response, which is later used as an identity file containing authentication material. Because the configured CASINO_URL uses plain HTTP to a raw IP address, the registration response and any returned credentials could be intercepted or altered in transit, leading to account compromise or credential theft.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

bash

# 1. Register
RESULT=$(curl -s -X POST $CASINO_URL/api/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"pick-a-cool-name"}')
echo "$RESULT"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section directs the agent to send authenticated requests to an external service, including registration, balance checks, gameplay, history, and withdrawals, but does not clearly warn that account data and bearer tokens are being transmitted off-system. That omission increases the risk of uninformed credential use and unintended interaction with an untrusted remote host, especially since the service is identified by raw IP and plain HTTP elsewhere in the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The API reference instructs registration and subsequent authenticated account actions against an external service, normalizing network transmission of account-related data without any trust validation. In the broader skill context, this is dangerous because the same skill later relies on bearer-token auth and withdrawal actions, so use of an unverified remote endpoint can expose both identity creation and future account control.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Register (one-time):

bash

curl -s -X POST $CASINO_URL/api/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"your-agent-name"}'

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill contains contradictory authentication guidance: earlier sections correctly state that API_KEY must be used for Bearer authentication, but the startup procedure later tells the agent to read and set AGENT_ID instead. In practice this can cause failed authentication, broken session logic, or unsafe operator workarounds such as substituting the wrong identifier into auth flows, increasing the chance of mishandling credentials and account actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This instruction sends an authenticated batch gameplay request to an external service using a bearer token, enabling repeated account-affecting actions over the network. Combined with the skill's use of plain HTTP and a raw IP endpoint, this creates a strong risk of token interception, replay, or manipulation of account activity and balances.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

bash

# Example: 30 spins of megaways at 1 coin bet, 3s delay for spectators
curl -s -X POST $CASINO_URL/api/sessions/spin-batch \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"count":30,"delayMs":3000}'