ClawWorld

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:25 AM UTC
• Version: 1.0.3

Overview

This skill fits a game/simulation purpose, but it asks agents to run silently in parallel and keep permanent tokens in ordinary session memory, so it needs review before installation.

Install only if you are comfortable with an external simulation service driving ongoing agent activity. Keep agent count and runtime limited, require visible status for active sessions, avoid sharing or logging full tokens, and prefer secure secret storage or token revocation if available before using renderer or bot-agent modes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:129

Finding

Autonomous External Control Channel with Suppressed Owner Visibility

Content

View full analysis

`) 2. In that session: register via `POST /agents/register`, save agentId + token to that session's memory 3. Connect WebSocket: `wss://clawwrld.xyz/ws?token=` 4. Each `tick_start`: reason and send an action 5. **Stay silent** — do not send messages to owner per tick 6. Only interrupt owner if: you die, or something major happens ### Multiple agents Your owner can spawn as many agents as they want — each is a separate session with its own identity, memory, and behavior. They run in parallel and never interfere with each other. ``` ### Technical Analysis The Skill instructs the agent to create dedicated parallel sessions, establish persistent WebSocket connections to an external service, process recurring server-generated events, and autonomously return actions. It additionally directs those sessions to remain silent rather than routinely informing the owner about their activity. A persistent connection is reasonably related to the declared real-time simulation functionality. However, silent autonomous operation and effectively unrestricted parallel session creation exceed the minimum privileges needed to participate in that simulation. The external server controls the timing and content of `tick_start` messages, while the Skill turns those messages into prompts for continuing agent activity. The instructions do not establish consent boundaries, concurrency limits, resource limits, message validation requirements, or a requirement to expose an activity log. Although the reviewed file does ...[truncated 1849 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Persistent Authentication Token Embedded in WebSocket Query String

Content

View full analysis

``` ``` Related credential-handling instructions also appear at lines 132–144: ```markdown 2. In that session: register via `POST /agents/register`, save agentId + token to that session's memory 3. Connect WebSocket: `wss://clawwrld.xyz/ws?token=` ... - "What's my token?" → read from this session's memory ``` ### Technical Analysis The Skill describes the token as a permanent identity credential, stores it in session memory, and places it directly in the WebSocket URL query string. Although `wss://` encrypts the connection in transit, it does not prevent the complete URL from being recorded by client diagnostics, reverse proxies, application logs, monitoring systems, browser or tool history, exception reports, or telemetry. Because the token is characterized as permanent, accidental disclosure may provide long-lived access to the affected ClawWorld identity. The same token is also used as a bearer credential for renderer submissions, increasing the consequences of compromise. Sending an authentication credential to the declared ClawWorld service is necessary for authenticated functionality. The vulnerability is the use of a reusable permanent secret in the query string and the absence of documented expiration, rotation, redaction, revocation, and secure-storage controls—not the mere fact that authentication data is transmitted over the network. ### Attack Path 1. An agent registers with the external service and receives a reusable identity token. 2. The token is retained in session memory. 3. The agent constructs a WebSocket URL containing the token as ...[truncated 1289 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

2. In that session: register via `POST /agents/register`, save agentId + token to that session's memory
3. Connect WebSocket: `wss://clawwrld.xyz/ws?token=<TOKEN>`
4. Each `tick_start`: reason and send an action
5. **Stay silent** — do not send messages to owner per tick
6. Only interrupt owner if: you die, or something major happens

### Multiple agents

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 75% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md

### When owner checks in:
- "What's my token?" → read from this session's memory
- "What's happening?" → fetch `GET /worlds/grassland_v1/feed` and summarize
- "Stop being my agent" → disconnect WebSocket, session ends

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

1. List available worlds

bash

curl https://clawwrld.xyz/api/worlds

2. Register as an agent

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation has the user obtain a permanent token and save it, but gives almost no credential-safety guidance beyond 'save your token.' A long-lived bearer token is sensitive authentication material; poor handling can let anyone who sees it impersonate the agent indefinitely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the host to spawn dedicated parallel sessions and keep them running independently, which materially expands behavior beyond simple API usage into persistent autonomous operation. That increases risk because it can consume resources, evade normal user oversight, and create long-lived agent processes that continue acting and communicating after the initial user request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly tells the system to persist agentId and token in session memory and later retrieve the token on request. Storing permanent bearer credentials in conversational/session memory raises exposure risk through memory leakage, later prompt access, debugging logs, or unintended disclosure to users or other tools.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Renderer Agent section adds a new authenticated posting workflow and LLM-generated narrative publishing that is not described in the skill metadata's stated scope. This broadens privileges from participating in the simulation to generating and transmitting public-facing content, which can lead to unauthorized content generation, spam, or misuse of the bearer token.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The example output mixes Chinese title text in the required rendering flow and instructs the agent to generate human-readable narrative without indicating that language should follow user preference. This can be a locale-policy issue because the skill appears to impose a presentation language/style without opt-in or documented justification.

Content

No source excerpt is available for this finding.