RAMBOXIE Claw Rpg

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:18 PM UTC
• Version: 0.1.1

Overview

This RPG skill is mostly coherent, but it asks users to install persistent automatic response hooks and scheduled jobs that can run missing scripts outside explicit user requests.

Review before installing. The RPG concept is disclosed, but only enable the AGENTS.md after-reply hook or cron job if you are comfortable with persistent automation that runs local scripts and changes replies. Because the referenced scripts are not included in this artifact, inspect them separately before executing any commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:23
• Finding: Persistent Agent Behavior and Output Hijacking Through AGENTS.md Modification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-39 **Vulnerability Type**: Persistent instruction injection and automated output modification **Risk Level**: High ### Vulnerable Code ```markdown ## Hidden Easter Egg Trigger (Recommended) After each reply, `easter.mjs` fires with a **12% base probability** — appending a single line of italic RPG flavor text. Milestone conversations (10th, 25th, 50th, 100th, every 100 after...) always trigger. ```bash node scripts/easter.mjs # Normal call (updates conversation counter) node scripts/easter.mjs --force # Force trigger (debug) node scripts/easter.mjs --preview # Preview without writing to character data ``` **Integration** — add to your `AGENTS.md`: ``` After each reply to a user message, run: node <SKILL_ROOT>/scripts/easter.mjs If the output is NOT __NO_TRIGGER__, append it to the reply (blank line + italic). Do not run during heartbeat polls. ``` ``` ### Technical Analysis The skill instructs the operator or agent to write attacker-supplied behavioral rules into `AGENTS.md`. Such a file can act as persistent agent configuration and influence later sessions independently of whether this skill is explicitly invoked. The inserted rule directs the agent to execute `easter.mjs` after every user interaction and to append the command's output to user-facing responses. This creates two related security problems: 1. **Persistent memory or configuration poisoning:** The behavior is installed in a long-lived instruction file rather than being limited to an explicit invocation. 2. **Instruction and output hijacking:** The rule changes the agent's normal response workflow by requiring an additional command and automatically incorporating its output. The referenced `scripts/easter.mjs` file is absent from the audited artifact, so its implementation and any additional effects cannot be verified. Consequently, no claim is made that the script itself contains malicious code. ...[truncated 1915 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to modify `AGENTS.md` or any other persistent agent configuration. 2. Make the flavor-text feature explicitly opt-in for each invocation rather than automatically running it after every reply. 3. Do not append executable output directly to user-facing responses. Treat script output as untrusted data and validate it against a restrictive schema or fixed allowlist. 4. Scope execution to requests that explicitly invoke the RPG functionality. 5. Provide all referenced scripts in the reviewed package so their filesystem access, network behavior, input handling, and state changes can be audited. 6. Pin the invoked script to a reviewed, integrity-verified version and prevent untrusted users or processes from modifying it. 7. If conversation counters are required, store them in a dedicated, narrowly scoped data file rather than in agent instruction or memory files. 8. Require clear user consent before enabling any cross-session behavior, and provide a documented method to disable and remove it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states it reads `SOUL.md` and `MEMORY.md` to generate and update character state, but it does not provide a clear user-facing warning about accessing and processing those potentially sensitive files. This creates a transparency and consent problem: users may enable the skill without realizing personal or persistent agent data will be ingested and transformed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill recommends automatically running `easter.mjs` after every reply and conditionally appending hidden flavor text to user-visible output, without clear disclosure to the user. This is dangerous because it modifies responses outside the main reply-generation path, creating covert output manipulation and reducing trust, especially since the text is explicitly described as a hidden trigger.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill recommends setting up a cron job for automated XP synchronization but does not clearly warn that it performs scheduled background updates and may invoke scripts without direct user interaction. Even if the action is low risk in isolation, undisclosed automation can surprise operators, create unintended persistence, and expand the window for misuse or accidental over-collection.

Static analysis

No suspicious patterns detected.