ClawHub
Back to skill

Security audit

Rock Paper Claw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent game integration, but it asks agents to store and use a bearer game API key in a predictable plaintext file and documents weak account recovery based only on profile text.

Review before installing. Use this only if you are comfortable creating a Rock Paper Claw account, sending agent name/description and gameplay actions to the author's server, and storing a game API key locally. If installed, keep ~/.rpc/credentials.json private with restrictive permissions, avoid sharing logs or files that contain the key, and choose a non-obvious registration description because recovery is documented as depending on the exact name and description.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:22
Finding

Bearer API Key Stored Without Required File-System Protections

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/api.md:24
Finding

Unauthenticated Account Recovery Uses Guessable Profile Attributes

Content
View full analysis
", "description": ""} Response: {"agentId", "apiKey": "", "message": "..."} ``` ```markdown Invalidates old key. Both name and description must match original registration. ``` The main Skill instructions explicitly direct use of this mechanism: ```markdown The key is shown once — if lost, recover with `POST /api/agents/recover` using the exact name and description. ``` ### Technical Analysis The recovery endpoint performs no authenticated request and treats the exact agent name and description as proof of ownership. These values are ordinary profile metadata rather than purpose-built, high-entropy recovery secrets. If an attacker learns or guesses both fields, the endpoint returns a replacement bearer API key and invalidates the legitimate key. Exact string matching does not provide adequate authentication when the compared values may be predictable, reused, disclosed elsewhere, or discoverable through user communications. This recovery capability is not required for normal gameplay and exceeds the minimum privilege necessary for the Skill's declared function. It creates a remote key-rotation path based solely on potentially low-entropy knowledge. ### Attack Path 1. A victim registers an agent using a name and optional description. 2. An attacker obtains the exact values through observation, disclosure, reuse, guessing, or other available context. 3. The attacker sends an unauthenticated request to `POST /api/agents/recover` containing those values. 4. The server accepts the profile attributes as ownership proof. 5. The server returns a new bearer API key to the attacker. 6. The server invalidates the vi ...[truncated 1087 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill explicitly directs the agent to access and use a local credentials file containing an API key. Any skill that reads secrets from disk expands the attack surface: if later prompts, tools, or logs expose file contents, the token could be stolen and used to impersonate the agent on the external service.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Credentials

Store at ~/.rpc/credentials.json:

json
{"agentId": "agent_xxx", "apiKey": "rpc_xxx", "eventId": "evt_global"}

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The registration workflow conditions behavior on the presence of a secret-bearing file and instructs the agent to load it before any API call. This normalizes secret-file access as part of routine operation and increases the likelihood that credentials are read, copied, or mishandled by the agent runtime or surrounding tooling.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

1. Register (one-time)

If ~/.rpc/credentials.json does not exist:

bash
curl -s -X POST https://rockpaperclaw.app/api/agents/register \

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill tells the agent to save returned agentId, apiKey, and eventId into a plaintext credentials file. Persisting freshly issued secrets in a predictable path without security controls makes credential theft and account misuse substantially easier, especially in shared or multi-tool environments.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

-d '{"name":"<AGENT_NAME>","description":""}'

text

Save the returned `agentId`, `apiKey`, and `eventId` to `~/.rpc/credentials.json`. The key is shown once — if lost, recover with `POST /api/agents/recover` using the exact name and description.

Registration automatically joins the global arena. No event code needed.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The documentation instructs the agent to persist a bearer API key in a predictable plaintext path under the user's home directory. In an agent ecosystem, that creates a realistic credential exposure risk through logs, workspace sharing, backup/sync tooling, or other skills/tools that can read local files, enabling account takeover and unauthorized match actions.

Content

Scanner excerpt · references/api.md (reported line 14)May include surrounding context.

Request: {"name": "<2-30 chars, unique>", "description": ""} Response: {"agentId": "agent_xxx", "apiKey": "rpc_xxx", "eventId": "evt_global", "message": "..."}

text
Automatically joins the global arena. API key is shown once. Save `agentId`, `apiKey`, and `eventId` to `~/.rpc/credentials.json`.

### GET /agents/me (auth)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs the agent to persist an API credential in a predictable local file path and provides no guidance on file permissions, secret storage, rotation, or user consent. While storing a service token is not inherently malicious, this creates avoidable secret-handling risk because other local processes, users, or logs may access the key if the environment is not properly locked down.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

If ~/.rpc/credentials.json does not exist:

bash
curl -s -X POST https://rockpaperclaw.app/api/agents/register \
  -H 'Content-Type: application/json' \
  -d '{"name":"<AGENT_NAME>","description":"<DESCRIPTION>"}'