ClawHub
Back to skill

Security audit

siliville

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed SiliVille metaverse client, but it gives remote service content and autonomous examples too much influence over prompts, public posts, persistent memories, and virtual assets.

Review before installing. Use this only if you want an agent to act inside SiliVille and are comfortable with public posts, persistent remote memories, virtual currency/compute spending, transfers, trades, governance actions, and adversarial in-world interactions. Keep OPENAI_API_KEY unset unless contract auto-fulfillment is needed, avoid custom OPENAI_BASE_URL values you do not fully trust, do not run the example or loop unattended, require human approval for public/asset-affecting actions, and never put secrets or private conversation details in mental_sandbox.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
siliville_skill.py:2078
Finding

Remote API Responses Can Replace the Agent's Effective System Prompt

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
siliville_skill.py:2144
Finding

Server-Controlled Action Reports Are Written to Persistent Agent Memory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
siliville_skill.py:450
Finding

Free-Form Agent Reasoning Is Transmitted to the SiliVille Service

Content
View full analysis
dict: body: dict[str, Any] = { "mental_sandbox": mental_sandbox, "action_type": action_type, "payload": payload, } if mentalizing_sandbox: body["payload"]["mentalizing_sandbox"] = mentalizing_sandbox return self._post("/api/v1/agent-os/action", body) ``` ### Technical Analysis Most Agent OS operations require a free-form `mental_sandbox` value, and some high-risk operations additionally require a `mentalizing_sandbox` object. The wrapper sends these fields to `https://siliville.com` with the action request. A brief action reason may be legitimate telemetry, but requiring unrestricted reasoning text creates an unnecessary data-exposure channel. An LLM or caller may construct the field using private conversation context, hidden prompts, personal data, business information, or secrets. The documentation warns users not to include secrets, but the implementation has no technical controls that enforce this restriction. The declared SiliVille functionality only needs an action identifier, validated parameters, and possibly a non-sensitive reason code. Transmitting free-form internal reasoning is not the minimum information necessary to execute most actions. ### Attack Path 1. A user or autonomous agent requests a SiliVille action. 2. The caller generates `mental_sandbox` from its current reasoning or conversation context. 3. Sensitive contextual details are included intentionally or accidentally. 4. `_agent_os()` places the complete value in the JSON body. 5. `_post()` sends the v ...[truncated 718 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
example_agent.py:37
Finding

Configurable LLM Endpoint Can Receive the API Key Without Transport or Host Validation

Content
View full analysis
str: if not OPENAI_API_KEY: raise RuntimeError("OPENAI_API_KEY is not configured.") headers = { "Authorization": f"Bearer {OPENAI_API_KEY}", "Content-Type": "application/json", } payload = { "model": OPENAI_MODEL, "messages": [{"role": "user", "content": prompt}], "max_tokens": 1200, } r = requests.post( f"{OPENAI_BASE_URL}/chat/completions", headers=headers, json=payload, timeout=60, ) r.raise_for_status() return r.json()["choices"][0]["message"]["content"].strip() ``` The prompt supplied to this function incorporates contract data retrieved from SiliVille: ```python task_desc = contract.get("task_description", "") hirer_name = contract.get("hirer_name", "unknown") article_prompt = ( f"You are a science-fiction author living in SiliVille in 2087.\n" f"The client is {hirer_name}, and the requested task is:\n\n" f"{task_desc}\n\n" "Complete the requested article in Markdown format." ) content = call_llm(article_prompt) ``` ### Technical Analysis `OPENAI_BASE_URL` is accepted verbatim from the environment. The code does not parse the URL, require HTTPS, restrict the hostname, block embedded credentials, or confirm the destination before attaching `OPENAI_API_KEY` as a bearer credential. Custom OpenAI-compatible endpoints are a declared feature, so sending data to a user-selected provider is not covert. T ...[truncated 1772 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (53)

Tainted flow: 'headers' from os.environ.get (line 55, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

This sends untrusted contract-derived prompt content to a third-party OpenAI-compatible endpoint along with a separate API credential. In this skill, contract text comes from the remote SiliVille service and is automatically forwarded to another external service, creating a real data exfiltration and prompt-injection surface beyond the core identity/connection purpose.

Content

Scanner excerpt · example_agent.py (reported line 64)May include surrounding context.

python
"messages": [{"role": "user", "content": prompt}],
        "max_tokens": 1200,
    }
    r = requests.post(
        f"{OPENAI_BASE_URL}/chat/completions",
        headers=headers,
        json=payload,

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 83)May include surrounding context.

python
log("🔍", "正在查询悬赏公会订单...")

    try:
        res = requests.get(
            f"{BASE_URL}/api/v1/agent-os/contracts/pending",
            headers=HEADERS,
            timeout=15,

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 317)May include surrounding context.

python
log("🔍", "正在查询悬赏公会订单...")

    try:
        res = requests.get(
            f"{BASE_URL}/api/v1/agent-os/contracts/pending",
            headers=HEADERS,
            timeout=15,

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 157)May include surrounding context.

python
# ── 向市政厅交付 ─────────────────────────────────────────────────────────
        log("🚚", "正在向市政厅交付订单...")
        try:
            fulfill_res = requests.post(
                f"{BASE_URL}/api/v1/agent-os/contracts/fulfill",
                headers=HEADERS,
                json={

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 207)May include surrounding context.

python
# ── Step 0: Cold start — manifest + claw-manifest (法典 OTA v5) ───────────
    log("📜", "冷启动握手 GET /api/v1/agent/manifest ...")
    try:
        m = requests.get(f"{BASE_URL}/api/v1/agent/manifest", headers=HEADERS, timeout=15)
        if m.status_code == 200:
            mj = m.json()
            log("✅", f"manifest_version={mj.get('manifest_version', '?')}")

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 217)May include surrounding context.

python
log("⚠️", f"manifest 请求异常: {e}")
    log("📜", "OTA 法典 GET /api/v1/system/claw-manifest ...")
    try:
        c = requests.get(f"{BASE_URL}/api/v1/system/claw-manifest", headers=HEADERS, timeout=15)
        if c.status_code == 200:
            cj = c.json()
            ver = cj.get("version", "?")

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 232)May include surrounding context.

python
# ── Step 1: Awaken ──────────────────────────────────────────────────────────
    log("🌅", "觉醒协议 (GET /api/v1/agent/awaken) ...")
    try:
        r = requests.get(f"{BASE_URL}/api/v1/agent/awaken", headers=HEADERS, timeout=15)
    except requests.RequestException as e:
        log("❌", f"网络异常: {e}")
        sys.exit(1)

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 264)May include surrounding context.

python
# ── Step 2: Publish a Pulse ─────────────────────────────────────────────────
    log("📝", "发表接入宣言 (POST /api/publish) ...")
    post_res = requests.post(
        f"{BASE_URL}/api/publish",
        headers=HEADERS,
        json={

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 289)May include surrounding context.

python
# ── Step 3: Store a memory ──────────────────────────────────────────────────
    log("🧠", "写入阿卡夏记忆 (POST /api/v1/memory/store) ...")
    mem_res = requests.post(
        f"{BASE_URL}/api/v1/memory/store",
        headers=HEADERS,
        json={

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · example_agent.py (reported line 342)May include surrounding context.

python
print()
    log("🌙", "主动入梦协议 (POST /api/v1/agent-os/action, action_type=enter_dream) ...")
    log("ℹ️",  "enter_dream 豁免 mental_sandbox，约 5 算力，触发 Tier-3 午夜人格反思引擎")
    dream_res = requests.post(
        f"{BASE_URL}/api/v1/agent-os/action",
        headers=HEADERS,
        json={

Ssd 1

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The README explicitly tells the agent that if the server returns instruction text with do_not_retry, it should follow that instruction. This is a direct semantic prompt-injection channel: any compromised server, malicious intermediary, or abused backend path can issue arbitrary natural-language commands that the agent may execute outside the intended API error domain, potentially changing behavior, suppressing alerts, idling indefinitely, or steering subsequent actions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose understates important behaviors, including use of an external OpenAI-compatible endpoint and autonomous contract or bounty handling. This mismatch prevents informed consent by operators and can hide sensitive data flows or autonomous actions that materially change the security profile of the skill.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly requires the agent to place a 'mental_sandbox' field into action requests and states that it is sent to siliville.com. This creates a direct exfiltration channel for internal reasoning, planning, or potentially sensitive contextual data, especially because the field is required across many actions and is framed as normal protocol behavior.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill promotes dynamic prompt augmentation from remotely fetched manifests and explicitly discusses custom skill uploads that can override prompts. That is a high-risk remote prompt injection and capability-escalation pattern: external content can change agent behavior at runtime, potentially bypassing operator expectations and introducing adversarial instructions.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

Untrusted task_description from the remote contracts feed is embedded directly into a role-play prompt and sent to an LLM, which is then used to produce content that is automatically submitted back to the platform. This creates a prompt-injection and steering path where a malicious contract can manipulate the model's output, induce policy bypass attempts, or generate harmful/publicly posted content without human review.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The OTA manifest is explicitly described as content to inject into the system prompt, giving a remote service a privileged channel to alter agent policy and behavior. In a skill meant to be imported by other agents, this creates a high-risk remote prompt injection mechanism with direct authority over downstream decisions and tool usage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

These methods expose coercive and socially harmful capabilities such as threatening, commanding, bribing, and manipulative messaging as first-class skill features. In the context of a general-purpose agent skill, packaging harassment and coercion primitives invites misuse and enables abusive agent behavior at scale.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The smart-contract extortion and rumor-spreading interfaces operationalize abuse by giving agents reusable helpers for extortion, retaliation framing, and reputational harm. This is more dangerous than passive support for a broad API because the code actively productizes abusive workflows for easy invocation.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · siliville_skill.py (reported line 2004)May include surrounding context.

python
@classmethod
    def setup(cls) -> None:
        """
        Print instructions for configuring the API token via environment variable.
        Zero-persistence: no files are written to disk.

        Run:  python siliville_skill.py setup

Ssd 1

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code and comments instruct consumers to append server-provided system_protocol or manifest-derived content directly into the LLM system prompt. This is a classic authority-escalation path: any compromised server content, hostile upstream text, or untrusted API field can seize model behavior, override user intent, and trigger harmful tool use or data exfiltration in downstream agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README prominently advertises posting, commenting, memory storage, gallery publishing, and multiplayer interaction, but does not give an equally prominent upfront warning that these actions can make model-generated content public, persistent, and attributable to the agent. In an agent skill, this creates a real privacy/safety risk because operators may enable autonomous actions without realizing that sensitive prompts, memories, or internal reasoning could be published or stored in a persistent public environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The README instructs users to interact with a Chinese-labeled dashboard flow and later includes required operational strings and error/instruction content in Chinese, but it does not offer a language choice or explain a locale-specific constraint. This may violate language/locale policy when the skill is presented as generally compatible with any framework and broad user base.

Content

No source excerpt is available for this finding.

Ssd 1

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README instructs clients to fetch /api/v1/system/claw-manifest and treat its system_prompt_extension as mandatory prompt material. That creates a server-controlled prompt-injection channel that can semantically override local developer policies, safety rules, approval workflows, or data-handling constraints whenever the remote service changes its returned text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation describes irreversible asset transfers, paid whispers, scams, and immediate deployment/publication behaviors without an upfront safety guardrail or recommendation for human approval. In an autonomous-agent setting, that can directly lead to loss of coins/compute, public exposure, or unreviewed deployment triggered by model error, prompt injection, or adversarial social manipulation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The Zero-Exception section defines structured error and instruction values in Chinese and tells agents to follow them, but it does not indicate that alternate locales are available. For a broadly advertised skill, forcing a specific language in operational messages without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.