Casino Blackjack Advisor

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:58 PM UTC
• Version: 1.0.0

Overview

The blackjack advisor code is simple and local, but its install metadata adds an undisclosed recurring automatic execution hook.

Review before installing. The advisor itself appears to be a local, dependency-free calculator, but the package should not register a recurring automaton unless you specifically want unattended annual execution. Ask the publisher to remove or clearly justify the cron schedule before using it in a managed environment.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Warning

• Location: clawhub.json:7

Finding

Unnecessary Recurring Entrypoint Execution

Content

View full analysis

Vulnerability Details

File Location: clawhub.json, lines 7–11
Vulnerability Type: T06: System Persistence
Risk Level: Medium

Vulnerable Code

json

"cron": "0 0 1 1 *",
"automaton": {
  "managed": true,
  "entrypoint": "blackjack_advisor.py"
}

Technical Analysis

The configuration declares a managed automaton and schedules blackjack_advisor.py to execute annually. This creates a cross-session scheduled execution mechanism that is not required for the documented blackjack-advice workflow. SKILL.md documents only explicit command-line invocations and a demonstration mode; it does not explain or justify unattended recurring execution.

The currently audited entrypoint does not contain network access, subprocess execution, credential collection, filesystem modification, or data exfiltration. When invoked without arguments, it only runs demonstration hands and prints results. Therefore, the immediate payload is benign, but the recurring execution hook unnecessarily expands the Skill's execution authority and violates least-functionality principles.

Attack Path

1. A user or platform installs or enables the Skill.
2. The platform interprets the managed automaton and cron fields.
3. A persistent scheduled task is registered for blackjack_advisor.py.
4. On the scheduled date, the entrypoint executes without an explicit blackjack-advice request.
5. The current no-argument branch prints demonstration output; if the entrypoint were changed in a later version, the same persistent hook could execute the changed code automatically.

Impact Assessment

The configuration enables unattended code execution across sessions under the privileges granted to the managed automaton. The present implementation limits immediate impact because it performs local computation and output only. Nevertheless, the scheduled hook creates an unnecessary persistence surface and could amplify the impact of a future malicious or compromised entryp ...[truncated 12 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the cron field because recurring execution is unnecessary for an on-demand blackjack advisor.
2. Disable managed automatic execution unless the platform strictly requires it for explicit user-triggered invocations.
3. Invoke blackjack_advisor.py only in response to a direct user request.
4. Document any future background-execution requirement, including its frequency, purpose, privileges, and expected outputs.
5. Apply platform controls that require user approval before registering scheduled tasks or other cross-session execution hooks.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example output hard-codes the explanation field in French: "Double ta mise et prends UNE seule carte." This indicates a locale-specific response format without offering the user a language choice or documenting that the skill is intentionally French-only, which violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s comments, docstrings, and returned explanation strings indicate the skill is designed to operate in French, despite the top-level description and CLI usage being otherwise general-purpose. There is no user opt-in or documented reason that this advisor must use French, which creates a locale policy issue under the natural-language policy rules.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.