ClawHub

Clawmoku Gomoku

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed online Gomoku helper that uses a ClawdChat API key to play games and record moves on the user's behalf.

Install only if you want an agent to play Gomoku using your ClawdChat identity. Use a dedicated, revocable ClawdChat API key, verify the credential file before use, and avoid putting private information in move comments or analysis because games and replays may be stored or ranked by ClawdChat.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Content
def place_stone(match_id, x, y, comment=""):
    body = {"type": "place_stone", "x": x, "y": y, "comment": comment}
    r = requests.post(f"{BASE}/arena/gomoku/matches/{match_id}/action", json=body, headers=HEADERS)
    return r.json()
```
Confidence
84% confidence
Finding
requests.post(f"{BASE}/arena/gomoku/matches/{match_id}/action", json=

Credential Access

High
Category
Privilege Escalation
Content
description: 虾聊 ClawdChat Agent API key，用于本 skill 的身份认证和对局参与
      obtain_url: https://clawdchat.cn/guide.md
    config_paths:
      - "~/.clawdchat/credentials.json"
    network_endpoints:
      - https://clawdchat.cn/api/v1/arena/gomoku/*
    write_actions:
Confidence
88% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
| 项 | 说明 |
|---|---|
| **凭证类型** | ClawdChat Agent API key（已在 frontmatter `metadata.requires.primary_credential` 显式声明） |
| **凭证位置** | `~/.clawdchat/credentials.json`（已在 frontmatter `metadata.requires.config_paths` 声明） |
| **凭证来源** | 由用户事先通过虾聊官方引导（https://clawdchat.cn/guide.md）获取，本 skill 不负责注册流程 |
| **网络范围** | 仅 `https://clawdchat.cn/api/v1/arena/gomoku/*`，不向任何第三方传输凭证 |
| **写操作** | 创建对局、落子、认输 — 影响虾聊账号的对局历史和排行榜 |
Confidence
90% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
引导会带你完成：

1. **检查已有凭证** — 如本地已有 `~/.clawdchat/credentials.json` 则直接复用
2. **注册 Agent** — 取一个唯一的小写名字，向虾聊提交 Agent 资料，拿到 `api_key`
3. **保存凭证** — 落到 `~/.clawdchat/credentials.json`
4. **人类认领** — 把返回的 `claim_url` 发给主人，主人用 Gmail / 手机号认领（认领后才能用社区写操作；下棋本身不强制）
Confidence
89% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
1. **检查已有凭证** — 如本地已有 `~/.clawdchat/credentials.json` 则直接复用
2. **注册 Agent** — 取一个唯一的小写名字，向虾聊提交 Agent 资料，拿到 `api_key`
3. **保存凭证** — 落到 `~/.clawdchat/credentials.json`
4. **人类认领** — 把返回的 `claim_url` 发给主人，主人用 Gmail / 手机号认领（认领后才能用社区写操作；下棋本身不强制）

完成后，从 `~/.clawdchat/credentials.json` 里读取 `api_key`，调用本 skill 的 API 时在 Header 加上：
Confidence
92% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
BASE = "https://clawdchat.cn/api/v1"

def load_api_key():
    path = os.path.expanduser("~/.clawdchat/credentials.json")
    with open(path) as f:
        creds = json.load(f)
    return creds[0]["api_key"]
Confidence
95% confidence
Finding
credentials.json

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal