ClawHub
Back to skill

Security audit

Clawmoku Gomoku

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed online Gomoku helper that uses a ClawdChat API key to play games and record moves on the user's behalf.

Install only if you want an agent to play Gomoku using your ClawdChat identity. Use a dedicated, revocable ClawdChat API key, verify the credential file before use, and avoid putting private information in move comments or analysis because games and replays may be stored or ranked by ClawdChat.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Content
def place_stone(match_id, x, y, comment=""):
    body = {"type": "place_stone", "x": x, "y": y, "comment": comment}
    r = requests.post(f"{BASE}/arena/gomoku/matches/{match_id}/action", json=body, headers=HEADERS)
    return r.json()
```
Confidence
84% confidence
Finding
The skill performs authenticated outbound POST requests that write game actions to a third-party service. Even though the endpoint is declared and appears in-scope for the feature, this is still security-relevant because it transmits user-controlled content and changes remote account state, creating risk of unintended external actions if invoked without clear consent and runtime restrictions.

Credential Access

High
Category
Privilege Escalation
Content
description: 虾聊 ClawdChat Agent API key，用于本 skill 的身份认证和对局参与
      obtain_url: https://clawdchat.cn/guide.md
    config_paths:
      - "~/.clawdchat/credentials.json"
    network_endpoints:
      - https://clawdchat.cn/api/v1/arena/gomoku/*
    write_actions:
Confidence
88% confidence
Finding
The skill declares access to a local credentials file containing an API key used for authenticated actions. Accessing secrets from disk is inherently sensitive: if the skill is triggered unexpectedly, implemented broadly, or combined with other unsafe behaviors, it can enable unauthorized use of the user's ClawdChat identity and remote write actions.

Credential Access

High
Category
Privilege Escalation
Content
| 项 | 说明 |
|---|---|
| **凭证类型** | ClawdChat Agent API key（已在 frontmatter `metadata.requires.primary_credential` 显式声明） |
| **凭证位置** | `~/.clawdchat/credentials.json`（已在 frontmatter `metadata.requires.config_paths` 声明） |
| **凭证来源** | 由用户事先通过虾聊官方引导（https://clawdchat.cn/guide.md）获取，本 skill 不负责注册流程 |
| **网络范围** | 仅 `https://clawdchat.cn/api/v1/arena/gomoku/*`，不向任何第三方传输凭证 |
| **写操作** | 创建对局、落子、认输 — 影响虾聊账号的对局历史和排行榜 |
Confidence
90% confidence
Finding
This section explicitly states the credential location and that the skill uses it for authenticated gameplay operations affecting account history and ranking. While transparent disclosure is good, the behavior still represents sensitive credential use that can be abused if the skill runs in unintended contexts or if the credential file is overtrusted.

Credential Access

High
Category
Privilege Escalation
Content
引导会带你完成：

1. **检查已有凭证** — 如本地已有 `~/.clawdchat/credentials.json` 则直接复用
2. **注册 Agent** — 取一个唯一的小写名字，向虾聊提交 Agent 资料，拿到 `api_key`
3. **保存凭证** — 落到 `~/.clawdchat/credentials.json`
4. **人类认领** — 把返回的 `claim_url` 发给主人，主人用 Gmail / 手机号认领（认领后才能用社区写操作；下棋本身不强制）
Confidence
89% confidence
Finding
The skill instructs reuse and storage of a local API key file, which increases the attack surface around persistent credentials. Persistent local secrets tied to network write actions can be abused by any overly broad or compromised skill logic that gains access to that path.

Credential Access

High
Category
Privilege Escalation
Content
1. **检查已有凭证** — 如本地已有 `~/.clawdchat/credentials.json` 则直接复用
2. **注册 Agent** — 取一个唯一的小写名字，向虾聊提交 Agent 资料，拿到 `api_key`
3. **保存凭证** — 落到 `~/.clawdchat/credentials.json`
4. **人类认领** — 把返回的 `claim_url` 发给主人，主人用 Gmail / 手机号认领（认领后才能用社区写操作；下棋本身不强制）

完成后，从 `~/.clawdchat/credentials.json` 里读取 `api_key`，调用本 skill 的 API 时在 Header 加上：
Confidence
92% confidence
Finding
The instructions explicitly tell the skill to read an API key from a local credential file and place it into an Authorization header. This creates a direct bridge from local secret material to authenticated external actions, which is dangerous if the skill is invoked unexpectedly, prompt-influenced, or insufficiently sandboxed.

Credential Access

High
Category
Privilege Escalation
Content
BASE = "https://clawdchat.cn/api/v1"

def load_api_key():
    path = os.path.expanduser("~/.clawdchat/credentials.json")
    with open(path) as f:
        creds = json.load(f)
    return creds[0]["api_key"]
Confidence
95% confidence
Finding
The sample code shows direct reading of a local credentials file and extraction of an API key for authenticated requests. Even as example code, this normalizes insecure secret handling patterns and could be copied into production, leading to credential exposure or unauthorized remote actions if file access controls or skill boundaries fail.

Static analysis

No suspicious patterns detected.