Security audit

Clawpet

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed virtual pet Mini App, but its public backend can let unauthenticated users modify or access other users' pet data and potentially escape intended storage paths.

Review carefully before installing or exposing this skill publicly. It should not be run on a public tunnel until Telegram initData validation, user ID validation, path containment, output escaping, CORS restrictions, and data retention controls are added.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server.py:348
Finding: Unauthenticated API Allows Cross-User Account Impersonation and State Modification
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server.py:113
Finding: Path Traversal Through User Identifiers Enables Arbitrary JSON File Access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index.html:572
Finding: Stored Cross-Site Scripting Through Pet Names, Dialogues, and User IDs
Content: View full analysis
📖 ' + (LANG === 'en' ? 'Pet Diary' : LANG === 'fr' ? 'Journal' : LANG === 'de' ? 'Tagebuch' : 'Pet Günlüğü') + '' + lines.slice(-3).map(l => '
• ' + l + '
').join(''); ``` Friend names and identifiers are also inserted into HTML and an inline event-handler attribute: ```javascript list.innerHTML = r.friends.map(f => `
${f.emoji}

${f.name} · L${f.level}

💕 Bond: ${f.bond || 0}

→
`).join(''); ``` ### Technical Analysis The application persists attacker-controlled pet names and subsequently interpolates tho ...[truncated 2123 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: server.py:241
Finding: Unescaped Pet Names Permit Active Content Injection in SVG Card Fallback
Content: View full analysis
{emoji} {pet.get('name','?')} Level {pet.get('level',1)} · 🔥 {pet.get('streak',0)} gün t.me/Bombaligrim_bot/pet ''' ``` ```python png = render_card(pet) if png is None: # Fallback: SVG svg = render_card_svg(pet) self.send_response(200) self.send_header('Content-type', 'image/svg+xml') self.end_headers() self.wfile.write(svg.encode('utf-8')) return ``` ### Technical Analysis When Pillow is unavailable, the server interpolates the stored pet name directly into SVG/XML markup. No XML escaping is applied. A malicious name can terminate the `` element and inject additional SVG elements, including active content supported when an SVG document is opened directly. The route is named `/card/.png`, but the fallback is served as `image/svg+xml`. The `.png` suffix does not make the response inert because browsers process the declared SVG media type. ### Attack Path 1. The attacker creates or overwrites a pet with a name containing an SVG-breaking payload. 2. The server stores the value without validation. 3. Pillow i ...[truncated 789 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:10
Finding: Non-Reproducible Dependency Installation Without a Lockfile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The markdown describes a full HTTP service with mutable POST endpoints, on-disk per-user storage, social interactions, and generated media, while the advertised skill purpose is only to return a Telegram deep link. In context, that concealment is more dangerous because the setup also recommends exposing the service publicly, which could let an under-reviewed backend process untrusted requests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The markdown describes a full HTTP service with mutable POST endpoints, on-disk per-user storage, social interactions, and generated media, while the advertised skill purpose is only to return a Telegram deep link. In context, that concealment is more dangerous because the setup also recommends exposing the service publicly, which could let an under-reviewed backend process untrusted requests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The markdown describes a full HTTP service with mutable POST endpoints, on-disk per-user storage, social interactions, and generated media, while the advertised skill purpose is only to return a Telegram deep link. In context, that concealment is more dangerous because the setup also recommends exposing the service publicly, which could let an under-reviewed backend process untrusted requests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown describes a full HTTP service with mutable POST endpoints, on-disk per-user storage, social interactions, and generated media, while the advertised skill purpose is only to return a Telegram deep link. In context, that concealment is more dangerous because the setup also recommends exposing the service publicly, which could let an under-reviewed backend process untrusted requests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown describes a full HTTP service with mutable POST endpoints, on-disk per-user storage, social interactions, and generated media, while the advertised skill purpose is only to return a Telegram deep link. In context, that concealment is more dangerous because the setup also recommends exposing the service publicly, which could let an under-reviewed backend process untrusted requests.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code implements an interactive local CLI game, while the declared skill behavior says it should only reply with a Telegram deep link. This mismatch expands the effective capability surface beyond what reviewers and users would expect, which is dangerous because hidden or undeclared functionality can bypass trust assumptions and security review scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description frames the skill as responding to /pet or 'virtual pet' by returning a Telegram deep link, implying a lightweight routing behavior for a Mini App. This documentation shows the repository also contains a terminal CLI, two separate web backends, local JSON persistence, Cloudflare tunnel deployment, and multiple bot integration scripts, which is materially broader than the stated skill behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README describes shareable visit links of the form pet_<userId> and use of Telegram share URLs without warning that these links embed user-associated identifiers and can be redistributed to groups. This creates a privacy risk by making user-linked pet profiles and social graph interactions easier to expose, enumerate, or correlate across chats.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly documents persistent storage of per-user records in users/{userId}.json and memorial/{userId}.json, including death/memorial state, but provides no notice about retention, visibility, or lifecycle of that data. In a social Telegram Mini App, this can expose user-associated gameplay history and identifiers beyond user expectations, especially because memorial pages and shared links are part of the product design.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 74% confidence
Finding: The skill declares no explicit tool permissions even though it describes capabilities that may access environment-dependent resources and invoke local tooling such as Python and install scripts. In agent ecosystems, missing scope declarations can lead to overbroad execution or unclear trust boundaries, making it harder to constrain what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger instructions explicitly require the agent to reply in Turkish ('yanıt olarak şu plain-text'i yollar') rather than matching the user's language or offering a choice. This creates a language-policy issue because the skill imposes a locale/language preference without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The skill recommends creating a persistent named Cloudflare tunnel and publicly routing a domain to a locally hosted service. In this context, that increases risk because the same document notes Telegram initData HMAC validation is still TODO, so a publicly reachable app may accept unauthenticated or spoofed requests and remain exposed beyond the intended session.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
text
3. (Opsiyonel) **Named tunnel** (URL kalıcı, viral patlama için kritik): ```bash cloudflared tunnel create openclaw-pet cloudflared tunnel route dns openclaw-pet pet.<your-domain> cloudflared tunnel run openclaw-pet

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The language detection returns 'tr' whenever the user's locale is not one of the supported languages. This imposes a specific language on users without offering a choice, which is a natural-language locale policy concern under the stated rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document is declared with lang="tr", and the runtime fallback also defaults to Turkish when language detection data is unavailable. The file does not present an explicit language choice or opt-in, so users may be forced into a specific locale by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code assigns LANG to the detected language or 'tr' as a hard fallback. Without an explicit user choice, this enforces a specific language for users whose locale cannot be detected, which matches the policy's language/locale violation pattern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code posts the Telegram-derived userId and pet metadata to /api/pet during pet creation, and similar background requests appear elsewhere in the file. There is no visible warning, notice, or explanatory text in this HTML informing users that their Telegram identifier and gameplay data will be transmitted to a server.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript file contains natural-language comments and a returned user-facing message in Turkish, but there is no indication that the skill is region-specific or that users can opt into the locale. The policy explicitly flags language/locale constraints when a specific language is imposed without user choice or justification.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 18)May include surrounding context.
sh
echo " ✓ already at $target (source)" return fi mkdir -p "$parent" if [[ -L "$target" ]]; then rm "$target" elif [[ -e "$target" ]]; then

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill writes persistent state to ~/.openclaw-pet.json even though the declared behavior is narrowly described as sending a Telegram deep link. Undeclared persistence is a security concern because it creates local side effects, stores data on disk, and indicates the implementation is doing more than the manifest promises.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Local filesystem read/write access is not justified by a skill whose stated purpose is to respond with a Telegram deep link. Even though this code only reads and writes a pet state file, unnecessary file access increases attack surface and violates least-privilege expectations for the declared skill context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 95% confidence
Finding: The API trusts a caller-supplied userId for all stateful operations and persists pet data on disk without any authentication or session binding. An attacker can impersonate any user by sending arbitrary userId values, then read, modify, befriend, revive, or otherwise manipulate another user's pet and social graph.
Content: Scanner excerpt · server.py (reported line 10)May include surrounding context.
python
POST /api/pet → action dispatcher Actions: create {type, name} → spawn new pet feed / play / sleep → mutate own pet visit {targetUserId} → read another user's pet (read-only) befriend {targetUserId} → add bidirectional friendship + bond bonus

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The helper selects Turkish as the default language whenever no language is provided, via (lang or 'tr'). This is a natural-language locale choice imposed by default rather than offered as an explicit user opt-in, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Incoming requests set lang to Turkish when the user does not supply a language, using (data.get('lang') or 'tr').lower(). That behavior enforces a specific locale by default instead of making language selection optional or user-driven.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: A standalone terminal readline pet game is a separate execution mode unrelated to replying with a Telegram Mini App deep link. That capability is not an obvious implementation requirement of the declared Telegram skill purpose.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The express dependency is also specified with a caret range, so installations are not reproducible and may resolve to different releases over time. That increases exposure to known or newly introduced supply-chain issues, especially for a package that commonly sits on the network edge in web apps.
Content: Scanner excerpt · package.json (reported line 11)May include surrounding context.
json
"keywords": ["openclaw", "skill", "pet", "game", "cli"], "author": "TURAC", "license": "MIT", "dependencies": { "chalk": "^4.1.2", "express": "^4.18.0" } }

Static analysis

No suspicious patterns detected.