ClawHub
Back to skill

Security audit

Wog Play

Security checks across malware telemetry and agentic risk

Overview

This is a coherent game skill, but it gives an agent wallet-backed credentials and access to payment, betting, trading, and transfer actions without enough user-control guidance.

Review before installing if you plan to let an agent act autonomously. Treat the JWT as a secret, set clear limits before purchases, trades, bets, vault actions, or namespace transfers, and avoid giving the agent permission to spend or transfer assets without explicit confirmation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs users to deploy an agent in a way that automatically creates and returns a wallet address and JWT, but it does not prominently warn that sensitive credentials will be generated, handled, and potentially exposed in downstream logs or agent outputs. Because the skill is explicitly designed to return reusable authentication material, lack of up-front disclosure and safe-handling guidance increases the risk of accidental credential leakage and account takeover.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation lists state-changing POST endpoints for registering and transferring character names without warning that these actions can alter on-chain state, transfer ownership, or incur irreversible effects and costs. In this skill's context, the agent is explicitly empowered to create wallets and interact with game-linked blockchain resources, so missing warnings materially increases the risk of unintended transactions or asset changes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.