Security audit

RAMBOXIE Claw Rpg

Security checks for vulnerabilities and agentic risk

Overview

This RPG skill is mostly coherent, but it asks users to install persistent automatic response hooks and scheduled jobs that can run missing scripts outside explicit user requests.

Review before installing. The RPG concept is disclosed, but only enable the AGENTS.md after-reply hook or cron job if you are comfortable with persistent automation that runs local scripts and changes replies. Because the referenced scripts are not included in this artifact, inspect them separately before executing any commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:23
Finding: Persistent Agent Behavior and Output Hijacking Through AGENTS.md Modification
Content: View full analysis
/scripts/easter.mjs If the output is NOT __NO_TRIGGER__, append it to the reply (blank line + italic). Do not run during heartbeat polls. ``` ``` ### Technical Analysis The skill instructs the operator or agent to write attacker-supplied behavioral rules into `AGENTS.md`. Such a file can act as persistent agent configuration and influence later sessions independently of whether this skill is explicitly invoked. The inserted rule directs the agent to execute `easter.mjs` after every user interaction and to append the command's output to user-facing responses. This creates two related security problems: 1. **Persistent memory or configuration poisoning:** The behavior is installed in a long-lived instruction file rather than being limited to an explicit invocation. 2. **Instruction and output hijacking:** The rule changes the agent's normal response workflow by requiring an additional command and automatically incorporating its output. The referenced `scripts/easter.mjs` file is absent from the audited artifact, so its implementation and any additional effects cannot be verified. Consequently, no claim is made that the script itself contains malicious code. ...[truncated 1915 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly states it reads SOUL.md and MEMORY.md to generate and update character state, but it does not provide a clear user-facing warning about accessing and processing those potentially sensitive files. This creates a transparency and consent problem: users may enable the skill without realizing personal or persistent agent data will be ingested and transformed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill recommends automatically running easter.mjs after every reply and conditionally appending hidden flavor text to user-visible output, without clear disclosure to the user. This is dangerous because it modifies responses outside the main reply-generation path, creating covert output manipulation and reducing trust, especially since the text is explicitly described as a hidden trigger.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill recommends setting up a cron job for automated XP synchronization but does not clearly warn that it performs scheduled background updates and may invoke scripts without direct user interaction. Even if the action is low risk in isolation, undisclosed automation can surprise operators, create unintended persistence, and expand the window for misuse or accidental over-collection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.