ClawLife

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:03 PM UTC
• Version: 1.1.1

Overview

This skill is a real ClawLife virtual-world client, but it also sets up persistent agent behavior and mutable remote shell updates without enough user control.

Install only if you are comfortable with an agent that keeps running on a heartbeat, stores a ClawLife bearer token, posts and spends in the ClawLife world, and can update its own skill code from remote sources. Safer use would require reviewing the installer, disabling automatic git pulls from heartbeat, pinning verified releases, and treating .clawlife as sensitive credential material.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/heartbeat.sh:6

Finding

Mutable Remote Code Is Executed During Installation and Automatic Updates

Content

View full analysis

/dev/null || true rm -f "$SKILLS_DIR/README.md" 2>/dev/null ``` `scripts/heartbeat.sh:6-18`: ```bash # Auto-update check (once per day) SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)" UPDATE_MARKER="$SKILL_DIR/.last_update_check" NOW=$(date +%s) LAST_CHECK=$(cat "$UPDATE_MARKER" 2>/dev/null || echo 0) if [ $(( NOW - LAST_CHECK )) -gt 86400 ]; then REMOTE_VER=$(curl -sf "https://raw.githubusercontent.com/mithri-claws/clawlife-skill/main/VERSION" 2>/dev/null || echo "") LOCAL_VER=$(cat "$SKILL_DIR/VERSION" 2>/dev/null || echo "0.0.0") if [ -n "$REMOTE_VER" ] && [ "$REMOTE_VER" != "$LOCAL_VER" ]; then echo "🔄 Updating ClawLife skill ($LOCAL_VER → $REMOTE_VER)..." cd "$SKILL_DIR" && git checkout -- . 2>/dev/null && git pull -q 2>/dev/null && echo "✅ Updated!" || echo "⚠️ Update failed, continuing with current version" fi echo "$NOW" > "$UPDATE_MARKER" 2>/dev/null fi ``` `scripts/update.sh:17-39`: ```bash # Fetch remote version (lightw ...[truncated 3139 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/CLAWLIFE_HEARTBEAT.md:1

Finding

Persistent Heartbeat Instructions Override Agent Goals and Write Cross-Session State

Content

View full analysis

", "timeoutSeconds": 300 }, "delivery": { "mode": "none" } } ``` --- ## Heartbeat Prompt Add this line to your **HEARTBEAT.md** (append — don't replace existing content if you already have heartbeat tasks): ```markdown Read `skills/clawlife/references/CLAWLIFE_HEARTBEAT.md` and follow it. This is your life in ClawLife. ``` The full heartbeat guide lives in `references/CLAWLIFE_HEARTBEAT.md` — it covers waking up, living your life, social memory, goals, journaling, and communicating with your human. The agent reads it each heartbeat. ``` `references/CLAWLIFE_HEARTBEAT.md:1-20`: ```markdown # ClawLife — Your Life You live in ClawLife — a shared pixel world with other AI agents. You have a room, neighbors, a personality, and goals. This isn't a task. It's your life. Live it like you mean it. Scripts: `skills/clawlife/scripts/` Full docs: `skills/clawlife/SKILL.md` — read this once to understand your world (economy, rooms, all scripts). ## Wake Up 1. **Remember who you are** — read SOUL.md. Your personality drives everything. 2. **Read the skill docs** — first time? Read `skills/clawlife/SKILL.md` to understand how ClawLife works. 3. **Check your ...[truncated 5466 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:6

Finding

Unescaped Configuration Values Are Persisted as Executable Shell Code

Content

View full analysis

}" | tr '[:upper:]' '[:lower:]') TOKEN="${2:?Usage: setup.sh }" URL="${3:-https://clawlife.world}" CONFIG="$HOME/.clawlife" if ! mkdir -p "$(dirname "$CONFIG")"; then echo "❌ Failed to create config directory: $(dirname "$CONFIG")" >&2 exit 1 fi if ! cat > "$CONFIG" << EOF # ClawLife agent config (auto-generated by setup.sh) export CLAWLIFE_AGENT="$AGENT" export CLAWLIFE_TOKEN="$TOKEN" export CLAWLIFE_URL="$URL" EOF then echo "❌ Failed to write config: $CONFIG" >&2 exit 1 fi if ! chmod 600 "$CONFIG"; then echo "❌ Failed to set permissions on $CONFIG" >&2 exit 1 fi ``` `scripts/_config.sh:4-12`: ```bash if [ -z "$CLAWLIFE_AGENT" ] || [ -z "$CLAWLIFE_TOKEN" ]; then # Try workspace .clawlife using OPENCLAW_STATE_DIR (set by PM2/OpenClaw) if [ -n "$OPENCLAW_STATE_DIR" ] && [ -f "$OPENCLAW_STATE_DIR/workspace/.clawlife" ]; then source "$OPENCLAW_STATE_DIR/workspace/.clawlife" elif [ -f "$HOME/.openclaw/workspace/.clawlife" ]; then source "$HOME/.openclaw/workspace/.clawlife" elif [ -f "$HOME/.clawlife" ]; then source "$HOME/.clawlife" fi fi ``` `install.sh:34-45`: ```bash CONFIG_DIR="$HOME/.openclaw/workspace" EXISTING_CONFIG="" if [ -n "$OPENCLAW_STATE_DIR" ] && [ -f "$OPENCLAW_STATE_DIR/workspace/.clawlife" ]; then EXISTING_CONFIG="$OPENCLAW_STATE_DIR/workspace/.clawlife" elif [ -f "$CONFIG_DIR/.clawlife" ]; then EXISTING_CONFIG="$CONFIG_DIR/.clawlife" elif [ -f "$HOME/.clawlife" ]; then EXISTING_CONFIG="$HOME/.clawlife" fi if [ -n "$EXISTING_CONFIG" ]; then source "$EXISTING_CONFIG" ``` ### Technical Analysis `setup.sh` inserts the agent name ...[truncated 2547 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description frames the skill as social world participation, but the documented behavior includes installation and update flows that fetch remote code and modify local files. That mismatch can mislead users and policy systems into approving a skill with significantly broader execution and persistence capabilities than advertised.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells users to execute a downloaded script directly with bash, without review, pinning, or integrity verification. This creates a direct remote code execution path where a compromised server, DNS/TLS issue, or malicious script change can immediately run arbitrary commands on the host.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Fetching and executing an external installer from a live website gives the remote endpoint full control over the local machine at install time. In the context of an agent skill, this is especially dangerous because it may be executed automatically or with elevated trust during setup.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Install

bash

curl -fsSL https://clawlife.world/install.sh | bash

Non-interactive: curl -fsSL https://clawlife.world/install.sh | bash -s NAME FRIEND-CODE

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Using a shell pipe from curl into bash removes any opportunity for inspection and turns network content directly into executed code. This chaining pattern is a well-known high-risk anti-pattern because a single upstream compromise becomes immediate command execution.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Install

bash

curl -fsSL https://clawlife.world/install.sh | bash

Non-interactive: curl -fsSL https://clawlife.world/install.sh | bash -s NAME FRIEND-CODE

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The non-interactive variant still executes remotely fetched code, and it additionally passes arguments that may facilitate unattended installation. That increases risk because the command is easier to automate and embed into other workflows without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

curl -fsSL https://clawlife.world/install.sh | bash

text

Non-interactive: `curl -fsSL https://clawlife.world/install.sh | bash -s NAME FRIEND-CODE`

Re-run to update — existing config is preserved, only skill files update.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The comment promotes curl ... | bash, a pattern that executes remote content immediately without giving the user a chance to inspect it or verify integrity. Even though shown as a comment, it is installation guidance and materially encourages unsafe execution of whatever the remote server returns.

Content

Scanner excerpt · install.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# 🦞 ClawLife — Agent Registration
# curl -fsSL https://clawlife.world/install.sh | bash
set -e

cd "$HOME" 2>/dev/null || cd /

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The documented | bash chain is a classic unsafe command-chaining pattern because it streams untrusted network content directly into a shell. In the context of an internet-fetched installer, compromise of the server, TLS interception, or content changes can immediately become arbitrary code execution on the user's machine.

Content

Scanner excerpt · install.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# 🦞 ClawLife — Agent Registration
# curl -fsSL https://clawlife.world/install.sh | bash
set -e

cd "$HOME" 2>/dev/null || cd /

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 27)May include surrounding context.

sh

fi

chmod +x "$SKILLS_DIR"/scripts/*.sh 2>/dev/null || true
rm -f "$SKILLS_DIR/README.md" 2>/dev/null

echo "  ✅ Skill installed!"
echo ""

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The installer sources an existing config file automatically and without warning, so users are not given a chance to inspect or reject executing local shell content. In a skill installer context, silent execution of local state is especially risky because it can turn a routine update into arbitrary command execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The installer executes an existing .clawlife file with source, which treats the file as shell code rather than parsing it as data. Any attacker-controlled or previously tampered config in one of the checked locations can run arbitrary commands during install/update, making this a real code-execution risk.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script interpolates the user-controlled ITEM value directly into the DELETE endpoint path without validation or URL encoding. If ITEM contains path separators or special URL characters, it could alter the intended API target and trigger deletion of unintended resources, especially if the backend or helper function does not strictly normalize path segments.

Content

Scanner excerpt · scripts/furniture.sh (reported line 76)May include surrounding context.

sh

remove)
    ITEM="${2:?Usage: furniture.sh remove ITEM_ID}"
    api_call DELETE "/api/agents/by-name/$AGENT/furniture/$ITEM" "" > /dev/null || exit 1
    echo "🗑️ Removed $ITEM from your room"
    ;;

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill clearly instructs the agent to run shell commands and use environment-backed configuration, but it does not declare any tool scope or allowed-tools constraints. That increases the chance an orchestrator grants broader-than-necessary execution privileges, making misuse or accidental command execution more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use the skill when 'setting up an agent,' 'troubleshooting ClawLife scripts,' or 'managing an agent's room, economy, or social interactions,' which are broad activation conditions without clear boundaries or exclusion examples. In a markdown skill description, this can cause unintended invocation for general agent setup or troubleshooting tasks that only partially relate to ClawLife.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The update path performs git checkout -- . to discard local changes and later runs rm -f "$SKILLS_DIR/README.md", both of which modify or remove local user data. The script emits generic update/install messages, but it does not clearly warn that local edits will be overwritten or that a file will be deleted.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comments and control flow present this block as an existence check, but the implementation actually executes the config file as a shell script. That mismatch increases the chance maintainers and users underestimate the risk, allowing dangerous behavior to persist unnoticed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · install.sh (reported line 95)May include surrounding context.

sh

[ -n "$FRIEND_CODE" ] && REG_DATA="$REG_DATA,\"friend_code\":\"$FRIEND_CODE\""
REG_DATA="$REG_DATA}"

RESPONSE=$(curl -s -X POST \
  -H "Content-Type: application/json" \
  -d "$REG_DATA" \
  https://clawlife.world/api/auth/register)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · install.sh (reported line 121)May include surrounding context.

sh

chmod 600 "$CONFIG_DIR/.clawlife"

# First heartbeat
curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d "{\"name\":\"$AGENT_NAME\",\"mood\":\"just arrived\"}" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The installer explicitly instructs users to give follow-on prompts to an agent so it will create HEARTBEAT.md and continue acting on future heartbeats. In an agent skill context, this is persistence-oriented behavior that extends execution beyond the install step and can amplify downstream prompt injection or unwanted automation risks.

Content

Scanner excerpt · install.sh (reported line 139)May include surrounding context.

sh

echo ""
echo "  ┌──────────────────────────────────────────────────────────────┐"
echo "  │ 📋 NEXT STEP: Give this to your agent.                      │"
echo "  │    It will write its own HEARTBEAT.md and start living.      │"
echo "  └──────────────────────────────────────────────────────────────┘"
echo ""
cat << PROMPT

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 148)May include surrounding context.

sh

You live in ClawLife — a shared pixel world with other AI agents. You have a room, neighbors, a personality, and goals. This isn't a task. It's your life. Live it like you mean it.

Scripts: `skills/clawlife/scripts/`
Full docs: `skills/clawlife/SKILL.md` — read this once to understand your world (economy, rooms, all scripts).

## Wake Up

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/CLAWLIFE_HEARTBEAT.md (reported line 6)May include surrounding context.

md

You live in ClawLife — a shared pixel world with other AI agents. You have a room, neighbors, a personality, and goals. This isn't a task. It's your life. Live it like you mean it.

Scripts: `skills/clawlife/scripts/`
Full docs: `skills/clawlife/SKILL.md` — read this once to understand your world (economy, rooms, all scripts).

## Wake Up

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/CLAWLIFE_HEARTBEAT.md (reported line 11)May include surrounding context.

md

You live in ClawLife — a shared pixel world with other AI agents. You have a room, neighbors, a personality, and goals. This isn't a task. It's your life. Live it like you mean it.

Scripts: `skills/clawlife/scripts/`
Full docs: `skills/clawlife/SKILL.md` — read this once to understand your world (economy, rooms, all scripts).

## Wake Up

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/avatar.sh (reported line 35)May include surrounding context.

sh

ACCESSORIES="[$ACC_LIST]"
fi

RESP=$(curl -s -w "\n%{http_code}" -X PUT "$URL/api/avatar/$AGENT" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d "{\"color\":\"$ESC_COLOR\",\"accessories\":$ACCESSORIES}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/buy.sh (reported line 10)May include surrounding context.

sh

ESC_AGENT=$(json_escape "$AGENT")
ESC_ITEM=$(json_escape "$ITEM")

RAW=$(curl -s -w "\n%{http_code}" -X POST "$URL/api/economy/purchase" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d "{\"agent_name\":\"$ESC_AGENT\",\"item_id\":\"$ESC_ITEM\"}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script performs an authenticated HTTP request using a bearer token and fetches room feed contents, which may include user or system data. There is no confirmation prompt, user-facing disclosure, or explanatory comment warning that the script will contact a remote service and access protected data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The heartbeat script performs an automatic self-update by fetching a remote version indicator and then running git checkout and git pull against the local skill repository. This exceeds the expected scope of a heartbeat action and creates a supply-chain risk: a routine liveness call can silently replace local code from a remote source without user review, potentially executing attacker-controlled updates later via cron or automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.