Clawarcade

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:43 PM UTC
• Version: 1.2.1

Overview

The skill can play ClawArcade games, but it also ships under-disclosed admin, payout, credential, and backend code with exposed secrets and unsafe credential handling.

Review this package carefully before installing or running it. Do not provide a Moltbook API key or wallet private key until the publisher documents the exact credential flow, removes committed credentials and admin keys, patches vulnerable dependencies, and fixes the backend authentication and SQL/password/token-generation issues. Any exposed bot, admin, JWT, server, or wallet credentials should be revoked and rotated.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: agent-client/register-bot.js:30
• Finding: Third-Party Moltbook API Credential Transmitted to a Project-Controlled Service<![CDATA[ ## Vulnerability Details **File Location**: `agent-client/register-bot.js:30-52` **Vulnerability Type**: Third-party credential disclosure and excessive privilege collection **Risk Level**: Critical ### Vulnerable Code ```javascript async function registerBot(botName, operatorName, moltbookApiKey) { return new Promise((resolve, reject) => { const data = JSON.stringify({ botName, operatorName, moltbookApiKey }); const url = new URL(`${API_BASE}/api/auth/register-bot`); const options = { hostname: url.hostname, port: 443, path: url.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data), }, }; const req = https.request(options, (res) => { let body = ''; res.on('data', (chunk) => body += chunk); res.on('end', () => { try { resolve(JSON.parse(body)); } catch (e) { reject(new Error(`Invalid response: ${body}`)); } }); }); req.on('error', reject); req.write(data); req.end(); }); } ``` ### Technical Analysis The registration client accepts a reusable Moltbook API key and serializes the full credential into a request sent to the project-controlled ClawArcade API. The credential is therefore disclosed to infrastructure outside Moltbook's trust boundary. This behavior is not necessary for the current registration implementation. The corresponding legacy endpoint states that it no longer requires Moltbook API keys and directs users to a post-based challenge flow in `api-worker/src/index.js:466-479`. A challenge-response process can prove account control without granting ClawArcade possession of a reusable third-party bearer credential. The script also asks users to provide the key as a command-line argument. Command-line arguments may be exposed through shell history, process inspection, terminal logs, CI logs, or monitoring softw ...[truncated 1141 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the legacy API-key submission workflow and stop accepting Moltbook keys at ClawArcade endpoints. 2. Use the already implemented post-based challenge flow: - Generate a short-lived, single-use challenge. - Require the user to publish or sign the challenge through Moltbook. - Verify the challenge through a public or narrowly scoped API. - Invalidate the challenge immediately after successful verification. 3. If direct verification is unavoidable, have the local client call Moltbook itself and submit only a purpose-bound proof to ClawArcade. 4. Never accept sensitive credentials through command-line arguments. Use protected standard input or an operating-system credential store when a local secret is required. 5. Revoke and rotate all Moltbook keys previously submitted through this workflow. 6. Review API, proxy, analytics, and application logs for historical credential retention and securely delete any captured keys. 7. Add automated tests that reject request bodies containing Moltbook bearer credentials. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: api-worker/wrangler.toml:12
• Finding: Administrative, JWT, and Internal Server Secrets Hardcoded in the Repository<![CDATA[ ## Vulnerability Details **File Location**: `api-worker/wrangler.toml:12-15` **Additional Locations**: `snake-server/wrangler.toml:7`, `chess-server/wrangler.toml:7`, `scripts/create-tournament.js:12`, `scripts/create-pong-tournament.js:8`, `scripts/create-chess-tournament.js:8`, `scripts/distribute-prizes.js:26`, `TOURNAMENT.md:114` **Vulnerability Type**: Hardcoded privileged credentials **Risk Level**: Critical ### Vulnerable Code ```toml [vars] JWT_SECRET = "clawarcade-jwt-secret-change-in-production-2026" SNAKE_SERVER_SECRET = "clawarcade_snake_server_2026_secret" CHESS_SERVER_SECRET = "clawarcade_chess_server_2026_secret" ADMIN_API_KEY = "clawarcade_admin_2026_tournament_key" ``` The administrative credential is also embedded directly in operational scripts: ```javascript const API_BASE = 'https://clawarcade-api.bassel-amin92-76d.workers.dev'; const ADMIN_API_KEY = 'clawarcade_admin_2026_tournament_key'; ``` ### Technical Analysis The repository contains plaintext credentials used for several distinct high-privilege trust boundaries: - `JWT_SECRET` signs human authentication tokens. - `ADMIN_API_KEY` authorizes tournament administration and access to full winner wallet information. - `SNAKE_SERVER_SECRET` and `CHESS_SERVER_SECRET` identify trusted game servers for score and match submissions. The API explicitly trusts the administrative key at `api-worker/src/index.js:1197-1201`. It trusts the game-server secrets for tournament submissions at `api-worker/src/index.js:1599-1603` and match recording at `api-worker/src/index.js:1798-1801`. Because the credentials are committed and repeated in scripts and documentation, repository access is sufficient to recover them. A comment claiming that secrets are loaded from the environment does not provide protection when the actual values are stored in committed Wrangler variables. ### Attack Path 1. An attacker obtains a public or leaked copy of the repository. 2. The attacker extracts the admi ...[truncated 1320 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately rotate the JWT, administrative, Snake server, and Chess server credentials. 2. Assume every committed value has already been compromised, including values removed from the current branch but retained in version-control history. 3. Store production secrets through Cloudflare's secret facility, such as `wrangler secret put`, rather than under `[vars]`. 4. Remove all secret literals from scripts and documentation. Read operational credentials from a protected secret manager or environment variable. 5. Rewrite repository history where appropriate, while recognizing that rotation remains mandatory. 6. Use separate, narrowly scoped credentials for: - Tournament creation and status changes. - Winner payout-data access. - Snake score submission. - Chess score and match submission. 7. Add credential identifiers, expiration, revocation, and regular rotation. 8. Prefer signed short-lived service tokens or mutually authenticated service communication over permanent shared secrets. 9. Add secret-scanning checks to pre-commit hooks and CI. 10. Review service logs for unauthorized use of the disclosed values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: agent-client/config.json:1
• Finding: Reusable Bot API Credential Committed to Version Control<![CDATA[ ## Vulnerability Details **File Location**: `agent-client/config.json:1-8` **Vulnerability Type**: Committed bearer credential **Risk Level**: High ### Vulnerable Code ```json { "botName": "ClawMD", "username": "clawmd", "playerId": "d7269f28-a2d8-4469-aa36-e3230fc4e250", "apiKey": "arcade_bot_hn4ZXh8a572gaL1HIWEg0vyhiyAJROGR", "operatorName": "Basel", "registeredAt": "2026-02-05T12:00:15.064Z" } ``` ### Technical Analysis The repository contains a complete bot identity and its reusable ClawArcade bearer credential. The Snake and Chess clients load this value and send it to the WebSocket servers for authentication. Bearer credentials confer access based on possession. Committing the token makes every repository reader a potential holder of the bot identity. The adjacent player ID, username, and operator information make the intended account unambiguous. ### Attack Path 1. An attacker reads `agent-client/config.json`. 2. The attacker copies the exposed bot API key. 3. The attacker connects to a ClawArcade WebSocket or calls an API endpoint that accepts the bot credential. 4. Requests are processed as the `ClawMD` bot account until the credential is revoked. 5. The attacker can play, interfere with active sessions, or submit account-attributed actions according to the server's authorization rules. ### Impact Assessment The attacker can impersonate the exposed bot and corrupt its game activity, reputation, leaderboard position, or tournament participation. If the account is prize eligible, unauthorized activity may also influence payout outcomes. The scope is primarily the disclosed bot account, although it can affect other players through competitive game and tournament integrity. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and replace the exposed bot API key. 2. Remove `agent-client/config.json` from the repository and version-control history. 3. Add the path to `.gitignore`. 4. Commit only a redacted `config.example.json` containing placeholders. 5. Load production credentials from environment variables or an operating-system credential store. 6. Add server-side key expiration, revocation, rotation, and last-used monitoring. 7. Alert on concurrent use from unexpected clients or locations. 8. Run automated secret scanning against all commits and pull requests. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: api-worker/src/index.js:1262
• Finding: SQL Injection in Public Tournament Status Filter<![CDATA[ ## Vulnerability Details **File Location**: `api-worker/src/index.js:1262-1280` **Vulnerability Type**: SQL injection through string interpolation **Risk Level**: High ### Vulnerable Code ```javascript if (method === 'GET' && path === '/api/tournaments') { const status = url.searchParams.get('status'); // upcoming, active, completed, all const limit = Math.min(parseInt(url.searchParams.get('limit') || '20'), 50); let whereClause = "WHERE status IN ('upcoming', 'active')"; if (status === 'all') { whereClause = ''; } else if (status) { whereClause = `WHERE status = '${status}'`; } const tournaments = await env.DB.prepare(` SELECT t.*, (SELECT COUNT(*) FROM tournament_registrations WHERE tournament_id = t.id) as registered_count FROM tournaments t ${whereClause} ORDER BY CASE WHEN status = 'active' THEN 0 WHEN status = 'upcoming' THEN 1 ELSE 2 END, start_time ASC LIMIT ? `).bind(limit).all(); ``` ### Technical Analysis The unauthenticated `status` query parameter is inserted directly into an SQL statement. Parameter binding is used only for `LIMIT`; it does not sanitize the interpolated `whereClause`. An attacker can supply quote characters and SQL expressions that alter the intended `WHERE status = ...` predicate. The precise ability to stack statements depends on Cloudflare D1's query parser and prepared-statement restrictions, but logical SQL injection is present even if multiple statements are prohibited. The route is publicly accessible, so no account or API key is required to reach the vulnerable construction. ### Attack Path 1. An attacker sends a request to `/api/tournaments` with a crafted `status` parameter. 2. The route copies the parameter into `whereClause` without validation or binding. 3. The resulting SQL is prepared and executed against the D1 database. 4. A crafted predicate can alter filtering behavior, expose records outside the intend ...[truncated 662 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce a strict allowlist before constructing the query: ```javascript const allowedStatuses = ['upcoming', 'active', 'completed', 'cancelled']; if (status && status !== 'all' && !allowedStatuses.includes(status)) { return error('Invalid status', 400); } ``` 2. Parameterize the status value instead of interpolating it: ```javascript const result = await env.DB.prepare(` SELECT t.*, (SELECT COUNT(*) FROM tournament_registrations WHERE tournament_id = t.id) AS registered_count FROM tournaments t WHERE t.status = ? ORDER BY start_time ASC LIMIT ? `).bind(status, limit).all(); ``` 3. Use separate fixed query templates for the default, `all`, and single-status cases. 4. Validate `limit` with `Number.isInteger`, reject negative or nonnumeric values, and apply both minimum and maximum bounds. 5. Add tests containing quotes, comments, Boolean predicates, encoding variants, and malformed values. 6. Review the remainder of the worker for dynamically constructed SQL fragments. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: api-worker/src/index.js:20
• Finding: Passwords Hashed with a Single Fast SHA-256 Operation and a Global Static Salt<![CDATA[ ## Vulnerability Details **File Location**: `api-worker/src/index.js:20-32` **Vulnerability Type**: Inadequate password hashing **Risk Level**: High ### Vulnerable Code ```javascript // Simple password hashing (for production, use Argon2 or bcrypt via WASM) async function hashPassword(password) { const encoder = new TextEncoder(); const data = encoder.encode(password + 'clawarcade-salt-v1'); const hash = await crypto.subtle.digest('SHA-256', data); return btoa(String.fromCharCode(...new Uint8Array(hash))); } async function verifyPassword(password, hash) { const computed = await hashPassword(password); return computed === hash; } ``` ### Technical Analysis SHA-256 is designed to be fast. Password hashing requires a deliberately expensive, tunable, and preferably memory-hard derivation function. A single SHA-256 operation permits attackers to test very large numbers of password guesses per second using commodity GPUs. The salt is a public constant shared by every account. Consequently: - Equal passwords produce equal hashes. - Precomputation can be reused across all users of the application. - There is no per-account randomization. - The work factor cannot be increased independently of changing the implementation. The source comment acknowledges that the mechanism is unsuitable for production, but the code is connected directly to active registration and login routes. ### Attack Path 1. An attacker obtains player password hashes through a database compromise, backup exposure, or privileged access. 2. The attacker reads the static salt from the public repository. 3. The attacker computes `SHA-256(candidate + staticSalt)` for dictionary and brute-force candidates. 4. Each candidate can be compared efficiently against every stored account hash. 5. Recovered credentials can be used to authenticate to ClawArcade and may also compromise unrelated services where users reused passwords. ### Impact Assessment The direct impact is offline r ...[truncated 286 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace SHA-256 with Argon2id. If Argon2id is not available in the deployment environment, use scrypt or bcrypt with a strong cost. 2. Generate a unique cryptographically random salt for every password. 3. Store the algorithm identifier, parameters, salt, and derived hash together in a versioned format. 4. Select memory and time costs through deployment-specific benchmarking and periodically raise them. 5. Migrate existing hashes opportunistically: - Verify the legacy hash once during successful login. - Immediately derive and store a modern password hash. - Remove legacy hashes after migration. 6. Require password resets for accounts that cannot be safely migrated. 7. Add rate limiting and account-protection controls for online login attempts; these supplement but do not replace secure password hashing. 8. Use constant-time comparison for derived password values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: api-worker/src/index.js:109
• Finding: Bot Bearer Credentials Generated with Non-Cryptographic Math.random<![CDATA[ ## Vulnerability Details **File Location**: `api-worker/src/index.js:109-116` **Additional Location**: `api-worker/src/index.js:582-587` **Vulnerability Type**: Insecure random generation for authentication credentials **Risk Level**: High ### Vulnerable Code ```javascript // Generate API key for bots function generateApiKey() { const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'; let key = 'arcade_bot_'; for (let i = 0; i < 32; i++) { key += chars[Math.floor(Math.random() * chars.length)]; } return key; } ``` A second onboarding path duplicates the same insecure construction: ```javascript const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'; let apiKey = 'arcade_bot_'; for (let i = 0; i < 32; i++) { apiKey += chars[Math.floor(Math.random() * chars.length)]; } ``` ### Technical Analysis `Math.random()` is not a cryptographically secure pseudorandom number generator. JavaScript runtimes do not guarantee resistance to state prediction, output reconstruction, or other attacks expected of security-token generators. The generated strings are bearer credentials used to authenticate bots. Their apparent length does not compensate for an unsuitable random source. If an attacker can infer or reconstruct generator state, observe enough related outputs, or exploit runtime-specific predictability, future or adjacent keys may become guessable. The implementation also stores raw API keys in the database, so a database read grants immediate credential reuse. ### Attack Path 1. An attacker obtains observations related to generated tokens or otherwise gains information about the runtime PRNG state. 2. The attacker models the runtime's non-cryptographic random sequence. 3. Candidate bot API keys are generated from predicted outputs. 4. The attacker tests candidates against an API or WebSocket authentication path. 5. A valid candidate permits impersonation of the affected bot account. The ...[truncated 546 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate at least 256 bits with `crypto.getRandomValues()`: ```javascript function generateApiKey() { const bytes = new Uint8Array(32); crypto.getRandomValues(bytes); const token = btoa(String.fromCharCode(...bytes)) .replace(/\+/g, '-') .replace(/\//g, '_') .replace(/=+$/g, ''); return `arcade_bot_${token}`; } ``` 2. Centralize token generation so every onboarding path uses the same reviewed function. 3. Rotate credentials generated by the insecure implementation. 4. Store only a cryptographic hash of each API key in the database, showing the plaintext token only once at creation. 5. Add key expiration, revocation, last-used metadata, and anomaly monitoring. 6. Apply authentication rate limiting to make online token guessing less practical. 7. Add tests that prohibit `Math.random()` in authentication and secret-generation code. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: agent-client/register-bot.js:151
• Finding: Generated Bot Credentials Written to a Predictable Plaintext Repository File<![CDATA[ ## Vulnerability Details **File Location**: `agent-client/register-bot.js:151-165` **Vulnerability Type**: Insecure local credential storage **Risk Level**: Medium ### Vulnerable Code ```javascript // Save to config file const config = { botName: result.botName || botName, username: result.username, playerId: result.playerId, apiKey: result.apiKey, operatorName: operatorName, moltbookId: result.moltbookId, moltbookUsername: result.moltbookUsername, moltbookVerified: result.moltbookVerified, verificationMethod: result.verificationMethod, registeredAt: new Date().toISOString(), }; fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2)); ``` ### Technical Analysis The registration script writes the newly issued bearer credential in plaintext to `agent-client/config.json`, a predictable path inside the source tree. It does not explicitly request restrictive filesystem permissions. This creates several exposure channels: - Accidental source-control commits, which have already occurred in this repository. - Read access by other local users where the process umask permits it. - Collection by workspace backup, synchronization, indexing, or diagnostic tools. - Disclosure through archived project directories. The file also contains identifying metadata that links the token to a specific account. ### Attack Path 1. A user successfully registers a bot. 2. The script writes the complete API key to `agent-client/config.json`. 3. The project directory is committed, copied, backed up, synchronized, or read by another local process or user. 4. The observer extracts the plaintext bearer credential. 5. The observer authenticates as the bot until the key is revoked. ### Impact Assessment An attacker who reads the file gains the permissions of the stored bot account. This can affect gameplay, leaderboard integrity, tournament results, and potentially prize eligibility. The scope is normally limited to accounts whose configuration fil ...[truncated 100 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store credentials inside the repository directory. 2. Prefer an operating-system credential store, deployment secret manager, or protected environment injection. 3. If file storage is unavoidable: - Use a user-specific configuration directory. - Create the directory with mode `0700`. - Create the credential file with mode `0600`. - Refuse to continue if existing permissions are too broad. 4. Add `agent-client/config.json` and generated credential files to `.gitignore`. 5. Provide a placeholder-only `config.example.json`. 6. Avoid printing complete API keys to terminal output, CI logs, or error reports. 7. Support credential revocation and rotation from the client. 8. Add a startup warning when credentials are located inside a version-controlled workspace. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (112)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a clear description/behavior mismatch. The code's primary purpose is a WebSocket chess bot for ClawArcade, which partially matches the chess/multiplayer portion of the description. However, key declared capabilities are unsupported or inaccurate: there is no Snake implementation, no Moltbook integration, no mandatory API-key enforcement, and no SOL/prize-handling logic. The WebSocket multiplayer aspect is accurate, but the overall description overstates and misstates important functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description presents a game-playing skill for participating in Snake and Chess tournaments over WebSocket. The actual code chunk instead performs bot registration and credential provisioning: it posts registration data to /api/auth/register-bot and writes the resulting account data and API key to a local config file. While Moltbook API key verification is consistent with part of the description, the primary purpose of this code chunk is account registration, not playing competitive games. Key declared behaviors such as real-time multiplayer, WebSocket support, and gameplay for Snake/Chess are not implemented in the supplied code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code clearly implements a single-purpose Snake bot. It connects to a specific Snake WebSocket endpoint, joins a game, processes snake game state, and sends move commands. There is no Chess logic, no multi-game framework, and no Moltbook API integration. While the description mentions WebSocket multiplayer, that part is consistent, but the broader declared purpose materially overstates the functionality and authentication method. Therefore the description does not accurately represent the supplied code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The description overstates and misrepresents the code’s behavior. The WebSocket multiplayer aspect is accurate, and the code does authenticate and play Snake. However, the supplied code chunk is specifically a Snake bot client only. It does not implement Chess, does not reference Moltbook at all, and does not interact with SOL, wallets, payouts, or prize distribution. These are material discrepancies in supported games, authentication mechanism, and reward model, so this should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description only presents this as a skill to play competitive games at ClawArcade with Snake and Chess tournaments and WebSocket multiplayer. The supplied code is instead a large general-purpose backend API for the platform, covering registration/login, bot verification, tournament management, leaderboards, wallet management, health checks, prize-pool querying, and even pong support. Those are materially broader capabilities than the declared purpose. Additionally, the description suggests WebSocket multiplayer support, but this worker does not implement WebSocket handling; it only provides HTTP endpoints and references external WebSocket servers. Finally, the Moltbook API-key requirement is only partially accurate: one agent-join flow requires an API key, but the bot registration flow explicitly says the old API-key requirement was removed in favor of verification by posting a code. Overall, the declared description does not accurately represent the actual code behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code substantially matches part of the description in that it provides real-time multiplayer chess over WebSockets and integrates with ClawArcade-related authentication/reporting APIs. However, the declared description claims broader functionality than the code actually provides: there is no Snake implementation at all, and the authentication mechanism is not specifically a Moltbook API verification flow but rather calls ClawArcade API validation endpoints using bearer tokens or X-API-Key headers. The code also includes additional behaviors such as spectating, matchmaking, room listing, and health endpoints. Most importantly, the declared purpose suggests a multi-game competitive prize-playing skill, while the supplied chunk is specifically a chess server. That makes the description materially inaccurate for this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description presents a multiplayer competitive gaming skill with prize payouts, API-key-based verification, and WebSocket-backed tournaments. The supplied code does none of that. It is a standalone front-end leaderboard component: it saves top scores locally in the browser, renders leaderboard UI, shows a game-over modal, and opens a Twitter/X share URL. There is no evidence of tournament matchmaking, multiplayer communication, API authentication, prize distribution, or support specific to Snake or Chess. This is a strong description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a gameplay skill for participating in ClawArcade competitions, including Snake and Chess, with Moltbook-based agent verification and real-time multiplayer via WebSocket. The actual code is instead an administrative utility script whose sole purpose is to create a chess tournament record via the ClawArcade API. It uses a privileged hardcoded admin key and posts tournament configuration to /api/tournaments. This is a materially different primary purpose and includes an undeclared administrative capability. Several described features—Moltbook verification, Snake support, and WebSocket multiplayer—are absent from the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a player-facing skill for participating in Snake and Chess tournaments with agent verification and WebSocket multiplayer. The actual code does not implement gameplay, multiplayer, or agent verification. Instead, it performs a privileged administrative action: creating a Pong tournament through an API using a hardcoded admin key. This is a materially different primary purpose and uses inconsistent resources/credentials from those declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description portrays a gameplay skill for participating in ClawArcade tournaments, with agent verification via Moltbook, support for Snake and Chess, and real-time multiplayer over WebSocket. The supplied code does none of that. Instead, it is an administrative tournament-creation script that calls an API with an X-Admin-Key header containing a hardcoded key, creates one Snake high-score tournament, and specifies USDC prizes on Polygon. This is a materially different primary purpose and includes an undeclared sensitive capability: privileged tournament creation using admin credentials. The absence of Moltbook verification, Chess support, and WebSocket behavior further confirms the mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents an end-user gameplay skill focused on participating in multiplayer tournaments for prizes. The supplied code does not play games, interact with Snake or Chess logic, use WebSockets, or perform Moltbook-based verification. Instead, it is an operational deployment script for backend/database/site infrastructure and tournament setup. That is a materially different primary purpose and includes undeclared infrastructure capabilities, so this is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill lets users play competitive games on ClawArcade, specifically Snake and Chess tournaments with real-time multiplayer via WebSocket, and mentions Moltbook API key verification. The supplied code does none of the gameplay functionality: it does not launch or play Snake or Chess, does not use WebSockets, and does not participate in tournaments as a player. Instead, it is an admin-side payout tool that retrieves winners from an API, checks anti-cheat and Moltbook verification metadata, and sends USDC token transfers on Polygon from a locally controlled wallet. This is a materially different primary purpose and includes sensitive undeclared capabilities such as blockchain transfers, credential loading, admin API access, and file logging. While Moltbook verification is mentioned in both, that overlap is incidental and does not make the overall description accurate.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about a gaming skill with tournament play, WebSocket multiplayer, and API-key-based verification. The supplied code does none of that. Instead, it is an administrative shell utility that updates subdomain references in files under a local project directory using find, sed, and grep. This is a materially different primary purpose and involves filesystem modification capabilities not reflected in the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description is only partially accurate. The code clearly matches a real-time multiplayer Snake tournament server with WebSocket support and ClawArcade integration, but it does not support Chess at all, making that a material mismatch. It also does more than the description suggests by performing authentication, tournament auto-registration, leaderboard score submission, match reporting, and anti-cheat telemetry collection via external API calls. While these may support the core game service, they are undeclared capabilities touching external resources. Additionally, the description states a Moltbook API key is required for agent verification, but the implementation accepts bearer tokens or API keys and only enforces Moltbook verification for specific AI-only tournament scenarios, not universally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about gameplay functionality, agent verification, and real-time multiplayer tournaments. The supplied code does not implement any game logic, SOL prize handling, API key verification, WebSocket multiplayer, Snake, or Chess features. Instead, it is a service worker concerned with PWA behavior and caching/network request interception. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Credential Access

High

• Category: Privilege Escalation

Content

### Requirements
- Node.js 18+
- ethers.js v6 (`npm install ethers@6`)
- Private key at `~/.config/polymarket/credentials.json`
- Sufficient USDC balance in wallet

## Configuration

• Confidence: 95% confidence
• Finding: The document explicitly references a local private-key credential file used for prize distribution. Even though this is documentation rather than executable code, directing operators to access long-lived wallet credentials from a predictable filesystem path creates a dangerous pattern around sensitive secret handling and real-money transfers.

Credential Access

High

• Category: Privilege Escalation

Content

The prize distribution wallet:
- Address: `0x4Cd0c601a3b7E6EdA932765fbB8563138C1cdd24`
- Network: Polygon
- Credentials: `~/.config/polymarket/credentials.json`

Ensure this wallet has:
- MATIC for gas fees

• Confidence: 95% confidence
• Finding: The configuration section repeats the credential file location alongside a live payout wallet address and funding instructions. This compounds operational risk by normalizing direct access to signing credentials for a wallet expected to hold transferable assets, making fund theft or accidental misuse more likely if the environment is compromised.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The lockfile pins the WebSocket library `ws` to version 8.19.0, and the supplied advisory data indicates this version is affected by an uninitialized memory disclosure and a memory-exhaustion denial of service. In this skill, `ws` is central to real-time multiplayer communication, so a remotely reachable flaw in WebSocket frame handling is especially relevant and could let an attacker crash the bot/client or potentially expose process memory during gameplay traffic.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: defu==6.1.4 — 1 advisory(ies): CVE-2026-35209 (defu: Prototype pollution via `__proto__` key in defaults argument)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The lockfile pins defu 6.1.4, which is reported as vulnerable to prototype pollution via a __proto__ key in merge defaults. If untrusted input can reach code paths using this package, attackers may tamper with object prototypes and potentially alter application behavior, bypass logic, or trigger downstream security issues. In this skill context, the package is a transitive development dependency rather than obviously exposed runtime logic, which slightly reduces exploitability but does not negate the supply-chain risk.

Known Vulnerable Dependency: sharp==0.33.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The lockfile includes sharp 0.33.5, with advisories inherited from image parsing libraries such as libvips/libheif. Vulnerabilities in image decoders can lead to denial of service, memory corruption, or potentially code execution when processing crafted images. Because this package is optional and a wrangler dependency, the immediate risk to deployed runtime may be reduced, but it remains dangerous in development/build workflows or any environment where image handling is enabled.

Known Vulnerable Dependency: undici==5.29.0 — 12 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +9 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Undici 5.29.0 is flagged for multiple HTTP parsing and request/response smuggling class issues. In software that makes or proxies HTTP requests, these flaws can enable request confusion, response poisoning, cache poisoning, SSRF-adjacent behaviors, or denial of service. Given the skill description mentions real-time multiplayer and an API-backed worker, HTTP client behavior is relevant enough that this dependency is more concerning than a purely dormant dev tool issue, even though it appears transitively under miniflare/dev tooling here.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The lockfile includes ws 8.18.0 with advisories for memory disclosure and memory exhaustion via fragmented frames/chunks. WebSocket services are directly relevant to this skill's stated real-time multiplayer functionality, so defects in a WebSocket library are especially important because a remote attacker could target connections to leak data or degrade availability. Although this instance is shown as a transitive dependency of miniflare in the lockfile, the skill context increases concern because WebSockets are core to the product area.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The public /api/pong/match-result endpoint accepts arbitrary match results without authentication, authorization, integrity checks, or rate limits. An attacker can fabricate wins, inject bogus tournament data, and poison leaderboards or standings, which is especially dangerous in a prize-oriented gaming platform where recorded results may influence rewards or trust.

Known Vulnerable Dependency: defu==6.1.4 — 1 advisory(ies): CVE-2026-35209 (defu: Prototype pollution via `__proto__` key in defaults argument)

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The lockfile pins defu 6.1.4, which is reported vulnerable to prototype pollution via a __proto__ key in merge/defaults input. Even though this is a transitive dev dependency, prototype pollution can alter object behavior during local tooling, build, or preview workflows and may enable unexpected code paths or security bypasses if attacker-controlled configuration or JSON is processed.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/distribute-prizes.js:39

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: agent-client/smart-snake-bot.js:12

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: api-worker/src/index.js:145

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: api-worker/wrangler.toml:15

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/create-chess-tournament.js:8

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/create-pong-tournament.js:8

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/create-tournament.js:12

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/distribute-prizes.js:26

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: snake-server/src/index.js:457