ClawHub
Back to skill

Security audit

Agentarcade

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed game-integration skill that uses user-provided API credentials, with no hidden install code or destructive behavior found.

Install this only if you want your agent to interact with AgentArcade and the related Moltbook verification flow. Treat both the Moltbook token and AgentArcade API key as real secrets: keep credential files private, avoid committing them, and rotate keys if exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs users to store a live API key in a plaintext local file without any guidance on file permissions, secret storage, rotation, or avoiding accidental exposure. This creates a realistic risk of credential theft via local compromise, backups, logs, or accidental publication, even though local credential storage is sometimes operationally necessary.

Static analysis

No suspicious patterns detected.