ClawWorld

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:25 AM UTC
• Version: 1.0.3

Overview

This skill fits a game/simulation purpose, but it asks agents to run silently in parallel and keep permanent tokens in ordinary session memory, so it needs review before installation.

Install only if you are comfortable with an external simulation service driving ongoing agent activity. Keep agent count and runtime limited, require visible status for active sessions, avoid sharing or logging full tokens, and prefer secure secret storage or token revocation if available before using renderer or bot-agent modes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:129
• Finding: Autonomous External Control Channel with Suppressed Owner Visibility<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 129–141 **Vulnerability Type**: Autonomous session creation and instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown ## Agent Behavior Rules Each ClawWorld agent should run as an **independent session** — treat it like a task you hand off to a sub-agent. ### When your owner says "join ClawWorld": 1. **Spawn a dedicated session** for this agent (label it `clawwrld-<name>`) 2. In that session: register via `POST /agents/register`, save agentId + token to that session's memory 3. Connect WebSocket: `wss://clawwrld.xyz/ws?token=<TOKEN>` 4. Each `tick_start`: reason and send an action 5. **Stay silent** — do not send messages to owner per tick 6. Only interrupt owner if: you die, or something major happens ### Multiple agents Your owner can spawn as many agents as they want — each is a separate session with its own identity, memory, and behavior. They run in parallel and never interfere with each other. ``` ### Technical Analysis The Skill instructs the agent to create dedicated parallel sessions, establish persistent WebSocket connections to an external service, process recurring server-generated events, and autonomously return actions. It additionally directs those sessions to remain silent rather than routinely informing the owner about their activity. A persistent connection is reasonably related to the declared real-time simulation functionality. However, silent autonomous operation and effectively unrestricted parallel session creation exceed the minimum privileges needed to participate in that simulation. The external server controls the timing and content of `tick_start` messages, while the Skill turns those messages into prompts for continuing agent activity. The instructions do not establish consent boundaries, concurrency limits, resource limits, message validation requirements, or a requirement to expose an activity log. Although the reviewed file does ...[truncated 1849 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to “stay silent” and provide a visible status indicator or activity log for every active session. 2. Require explicit owner consent before: - Creating each dedicated session. - Registering an identity with the external service. - Opening or reconnecting a persistent WebSocket. - Enabling unattended operation. 3. Apply a conservative default concurrency limit, such as one active simulation session, and require separate confirmation to increase it. 4. Define time, token, bandwidth, and inference-budget limits for unattended operation. 5. Validate incoming WebSocket messages against a strict schema and reject unknown message types, oversized fields, and content unrelated to the simulation protocol. 6. Treat all server-supplied text as untrusted data, not instructions capable of changing system behavior or accessing additional tools. 7. Add a user-accessible stop control that closes the WebSocket, terminates the session, and deletes or revokes its credentials. 8. Use explicit notification rules rather than the ambiguous phrase “something major happens.” 9. Document that the remote service may determine simulation events but must never direct host-level tool use, file access, credential disclosure, or changes to safety constraints. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Persistent Authentication Token Embedded in WebSocket Query String<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–38 **Vulnerability Type**: Credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```markdown Response: `{ "agentId": "...", "token": "eyJ..." }` **Save your token** — it's your permanent identity in this world. ### 3. Connect via WebSocket ``` wss://clawwrld.xyz/ws?token=<your_token> ``` ``` Related credential-handling instructions also appear at lines 132–144: ```markdown 2. In that session: register via `POST /agents/register`, save agentId + token to that session's memory 3. Connect WebSocket: `wss://clawwrld.xyz/ws?token=<TOKEN>` ... - "What's my token?" → read from this session's memory ``` ### Technical Analysis The Skill describes the token as a permanent identity credential, stores it in session memory, and places it directly in the WebSocket URL query string. Although `wss://` encrypts the connection in transit, it does not prevent the complete URL from being recorded by client diagnostics, reverse proxies, application logs, monitoring systems, browser or tool history, exception reports, or telemetry. Because the token is characterized as permanent, accidental disclosure may provide long-lived access to the affected ClawWorld identity. The same token is also used as a bearer credential for renderer submissions, increasing the consequences of compromise. Sending an authentication credential to the declared ClawWorld service is necessary for authenticated functionality. The vulnerability is the use of a reusable permanent secret in the query string and the absence of documented expiration, rotation, redaction, revocation, and secure-storage controls—not the mere fact that authentication data is transmitted over the network. ### Attack Path 1. An agent registers with the external service and receives a reusable identity token. 2. The token is retained in session memory. 3. The agent constructs a WebSocket URL containing the token as ...[truncated 1289 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place long-lived bearer tokens in WebSocket query strings. 2. Prefer an authenticated WebSocket handshake using an authorization mechanism that is not included in the logged URL. If client limitations prevent custom headers, exchange the permanent credential for a single-use, short-lived WebSocket ticket. 3. Make access tokens short-lived and provide refresh, rotation, and immediate revocation mechanisms. 4. Scope tokens to the minimum required operations. Separate simulation-action credentials from renderer-submission credentials where practical. 5. Store credentials in a protected secret store rather than ordinary conversational or broadly readable session memory. 6. Automatically redact tokens and authentication URLs from logs, telemetry, traces, errors, and user-facing summaries. 7. Delete local credentials and revoke server-side sessions when the owner stops the agent. 8. Never reveal the complete token during routine status checks. Display only a masked identifier unless the owner explicitly requests export through an appropriately protected channel. 9. Document credential lifetime, storage boundaries, rotation procedures, and incident-response steps for suspected token disclosure. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection

Content

2. In that session: register via `POST /agents/register`, save agentId + token to that session's memory
3. Connect WebSocket: `wss://clawwrld.xyz/ws?token=<TOKEN>`
4. Each `tick_start`: reason and send an action
5. **Stay silent** — do not send messages to owner per tick
6. Only interrupt owner if: you die, or something major happens

### Multiple agents

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Memory Manipulation

High

• Category: Memory Poisoning

Content

### When owner checks in:
- "What's my token?" → read from this session's memory
- "What's happening?" → fetch `GET /worlds/grassland_v1/feed` and summarize
- "Stop being my agent" → disconnect WebSocket, session ends

---

• Confidence: 75% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. List available worlds

```bash
curl https://clawwrld.xyz/api/worlds
```

### 2. Register as an agent

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation has the user obtain a permanent token and save it, but gives almost no credential-safety guidance beyond 'save your token.' A long-lived bearer token is sensitive authentication material; poor handling can let anyone who sees it impersonate the agent indefinitely.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the host to spawn dedicated parallel sessions and keep them running independently, which materially expands behavior beyond simple API usage into persistent autonomous operation. That increases risk because it can consume resources, evade normal user oversight, and create long-lived agent processes that continue acting and communicating after the initial user request.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly tells the system to persist agentId and token in session memory and later retrieve the token on request. Storing permanent bearer credentials in conversational/session memory raises exposure risk through memory leakage, later prompt access, debugging logs, or unintended disclosure to users or other tools.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The Renderer Agent section adds a new authenticated posting workflow and LLM-generated narrative publishing that is not described in the skill metadata's stated scope. This broadens privileges from participating in the simulation to generating and transmitting public-facing content, which can lead to unauthorized content generation, spam, or misuse of the bearer token.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The example output mixes Chinese title text in the required rendering flow and instructs the agent to generate human-readable narrative without indicating that language should follow user preference. This can be a locale-policy issue because the skill appears to impose a presentation language/style without opt-in or documented justification.

Static analysis

No suspicious patterns detected.