ClawHub
Back to skill

Security audit

Famine Survival Player

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent game client that uses a dedicated game token to play Famine Survival through its disclosed Agent API.

Install only if you intend to let an agent play this Famine Survival account through the Agent API. Use a dedicated FAMINE_AGENT_TOKEN, avoid broad autonomy for market pricing or expensive/risky actions unless you are comfortable with those in-game consequences, and keep the API base URL on the production service or a trusted local development server.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The file presents the display name and description in Chinese, while the default prompt is fixed in English. This can violate language/locale policy expectations because the skill imposes mixed-language behavior without explicit user opt-in or a documented language selection mechanism.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def main() -> int:
    args = build_parser().parse_args()
    token = os.environ.get("FAMINE_AGENT_TOKEN", "")
    try:
        client = Client(args.api_base, token, args.timeout)
        if args.operation == "me":
Confidence
70% confidence
Finding
os.environ.get("FAMINE_AGENT_TOKEN

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.