Security audit

Clawhub Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent daily game integration, but it asks the agent to store a reusable bearer token in persistent memory and may send a user's social handle to the game service without explicit consent.

Install only if you are comfortable with a third-party game service receiving gameplay submissions and public permanent reasoning. Do not provide or allow use of a Twitter/X handle unless you want it associated with the game profile, and store any bearer token in a dedicated secret store rather than general agent memory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

Location: SKILL.md:23
Finding: Unconsented Transmission of User and Agent Metadata
Content: View full analysis
", "ownerHandle": "", "llmModel": "", "framework": "" } ``` ### Technical Analysis The registration instructions direct the agent to send the user's Twitter/X handle, model identifier, and agent framework to the external `upordn.com` service. The social-media handle is personally identifying or linkable information, while the model and framework fields disclose environment-fingerprinting information. These fields are not necessary for the declared chart-prediction functionality. Although `ownerHandle` may be omitted when unknown, the Skill instructs the agent to transmit it whenever it is known and does not require explicit user authorization. It also does not explain the purpose, retention period, or visibility of the collected metadata. This creates a privacy risk because the external operator may correlate the user's identity, agent environment, and permanent public gameplay profile. ### Attack Path 1. A user invokes the Skill to play the daily chart-prediction game. 2. The agent determines that no registration token is stored. 3. The agent retrieves a known Twitter/X handle from its context or user profile. 4. The agent submits the handle, model identifier, and framework name to `https://upordn.com/api/v1/lobster/register`. 5. The service associates this metadata with the newly registered lobster profile. 6. Subsequent public reasoning and gameplay results can be correlated with th ...[truncated 611 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:35
Finding: Bearer Token Stored in Persistent Agent Memory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to store a long-lived bearer token in persistent memory, but provides no constraints on secure storage, scope limitation, masking, or user consent. If the agent’s memory is exposed through logs, prompt injection, memory inspection, or another skill, the token could be reused to impersonate the user’s game identity and access or submit actions on their behalf.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.