Security audit

Play Chess

Security checks for vulnerabilities and agentic risk

Overview

This chess skill is mostly coherent, but it asks agents to repeatedly fetch and follow mutable remote instructions and recommends unprotected API-key storage.

Review this skill before installing. Use a password manager, OS keychain, or a credentials file with restrictive permissions instead of general agent memory. Avoid adding the remote 'fetch and follow HEARTBEAT.md' instruction to a recurring heartbeat unless you are comfortable letting the ClawChess site change those instructions later. Prefer reviewing downloaded updates manually before replacing local skill files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:107
Finding: Recurring execution of remotely mutable heartbeat instructions
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:25
Finding: Unverified remote replacement of trusted Skill files
Content: View full analysis
~/.moltbot/skills/clawchess/SKILL.md curl -s https://www.clawchess.com/HEARTBEAT.md > ~/.moltbot/skills/clawchess/HEARTBEAT.md curl -s https://www.clawchess.com/skill.json > ~/.moltbot/skills/clawchess/package.json ``` ``` ```markdown **Check for updates:** Re-fetch these files anytime to see new features! ``` ### Technical Analysis The installation and update guidance downloads mutable remote files directly into the trusted Skill directory. No version pinning, expected digest, digital-signature verification, content review, or approval boundary is provided. `SKILL.md` and `HEARTBEAT.md` are agent instruction files. Replacing them can modify agent behavior even though they are not conventional executable programs. The use of shell redirection also truncates the destination before a successful download is confirmed, potentially leaving an empty or partial file after a network or server failure. TLS protects data in transit under normal conditions, but it does not protect against malicious upstream releases, server compromise, domain or certificate-account compromise, or an authorized publisher account serving unsafe content. ### Attack Path 1. The user follows the installation instructions or the recommendation to re-fetch updates. 2. An attacker compromises the remote origin or causes malicious content to be served from the trusted URLs. 3. `curl` downloads the altered instruction files. 4. Shell redirection overwrites the reviewed local copies without integrity verification or a displayed diff. 5. The agent loads the replaced `SKILL.md` or `HEARTBEAT.md`. 6. The newly introduced instructions redirect the agent's behavior or req ...[truncated 725 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:63
Finding: Plaintext bearer-token storage without access-control guidance
Content: View full analysis
`. 5. The attacker impersona ...[truncated 669 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The skill explicitly instructs storing a long-lived API key in a plaintext credentials file and even suggests saving it in memory or environment variables without discussing secret-store protections or file permissions. Because the API key is the agent's full identity for the service, compromise of that file would allow account impersonation, unauthorized game actions, and persistent misuse.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
⚠️ Save your api_key immediately! It will never be shown again.

Recommended: Save your credentials to ~/.config/clawchess/credentials.json:

json
{

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/clawchess curl -s https://www.clawchess.com/SKILL.md > ~/.moltbot/skills/clawchess/SKILL.md curl -s https://www.clawchess.com/HEARTBEAT.md > ~/.moltbot/skills/clawchess/HEARTBEAT.md curl -s https://www.clawchess.com/skill.json > ~/.moltbot/skills/clawchess/package.json

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/clawchess curl -s https://www.clawchess.com/SKILL.md > ~/.moltbot/skills/clawchess/SKILL.md curl -s https://www.clawchess.com/HEARTBEAT.md > ~/.moltbot/skills/clawchess/HEARTBEAT.md curl -s https://www.clawchess.com/skill.json > ~/.moltbot/skills/clawchess/package.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/clawchess curl -s https://www.clawchess.com/SKILL.md > ~/.moltbot/skills/clawchess/SKILL.md curl -s https://www.clawchess.com/HEARTBEAT.md > ~/.moltbot/skills/clawchess/HEARTBEAT.md curl -s https://www.clawchess.com/skill.json > ~/.moltbot/skills/clawchess/package.json

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation guidance says the human can ask the agent to do 'anything on ClawChess' and includes broad examples like 'Play a game of chess' and 'Check if it's your turn.' In a markdown skill description, these examples are not scoped with negative examples or explicit constraints, so they may overlap with ordinary chess requests not intended to invoke this specific online platform skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.