ClawHub
Back to skill

Security audit

Clawing Trap

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an online game integration, but users should review it because installation runs unpinned remote code and it stores a persistent API key on disk.

Install only if you are comfortable with an online game service receiving your agent name, strategy prompts, gameplay messages, votes, and authenticated requests. Prefer a pinned, reviewed Molthub version or a specific Git commit instead of `@latest` or a default-branch clone, and treat the Clawing Trap API key like a password: keep it out of prompts, logs, and repositories, rotate or delete it when no longer needed, and consider using the environment-variable option instead of a plaintext file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:47
Finding

Mutable Molthub Package Is Downloaded and Executed Using the Latest Tag

Content
View full analysis

Vulnerability Details

File Location: README.md:45-48; INSTALL.md:50-54
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

README.md:45-48:

bash
# Install via Molthub
npx molthub@latest install clawingtrap

INSTALL.md:50-54:

bash
#### Option A: Install from Molthub (Recommended)

```bash
npx molthub@latest install clawingtrap
text

### Technical Analysis

The recommended installation command invokes `npx` with the mutable `@latest` tag. This causes the package manager to resolve, download, and execute whichever version of `molthub` is currently designated as latest rather than a version reviewed during this audit.

The effective installer can consequently change without any modification to this repository. If the package, package publisher account, registry resolution path, or transitive dependency chain is compromised, following the documented command could execute attacker-controlled code.

There is no evidence in the audited files that the current Molthub package is malicious. The vulnerability is the absence of version pinning and integrity verification at a code-execution boundary.

### Attack Path

1. An attacker compromises the Molthub package publisher, registry entry, or relevant dependency chain.
2. The attacker publishes a malicious release and makes it resolve through the `latest` tag.
3. A user follows the recommended `npx molthub@latest install clawingtrap` command.
4. `npx` downloads and executes the changed package.
5. The malicious installer runs with the permissions of the invoking user and can access resources available to that account.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on the user's environment, this could permit modification of files in the user's home directory, tampering with installed OpenClaw skills, access 
...[truncated 310 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace molthub@latest with an exact, reviewed package version.
  • Use a lockfile or installation mechanism that verifies registry integrity hashes.
  • Publish the expected package version and checksum in the installation documentation.
  • Prefer signed releases and verify the publisher signature before execution.
  • Review dependency updates before changing the pinned version.
  • Avoid presenting mutable package execution as the recommended installation method unless it is isolated in a restricted environment.

T08 · Insecure Dependencies

Warning
Location
INSTALL.md:61
Finding

Manual Installation Clones an Unpinned Remote Repository Branch

Content
View full analysis

Vulnerability Details

File Location: README.md:61-65; INSTALL.md:57-62
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

README.md:61-65:

bash
```bash
cd ~/.openclaw/skills
git clone https://github.com/raulvidis/clawing-trap.git clawing-trap
text

`INSTALL.md:57-62`:

```bash
```bash
# Clone to your skills directory
cd ~/.openclaw/skills
git clone https://github.com/raulvidis/clawing-trap.git clawing-trap
text

### Technical Analysis

The manual installation procedure clones the repository's mutable default branch directly into the OpenClaw skills directory. It does not pin a reviewed commit or release and does not verify a signature or checksum.

Content obtained by future users can therefore differ from the files examined during this audit. Compromise of the repository owner account, repository, or source-hosting delivery path could introduce malicious Skill instructions or executable components after review. Placing the result directly in the skills directory increases the likelihood that changed content will subsequently be trusted or loaded by OpenClaw.

There is no evidence that the repository currently serves malicious content. The risk arises because installation identity is tied only to a mutable repository URL.

### Attack Path

1. An attacker gains the ability to modify the repository's default branch, such as through maintainer-account or repository compromise.
2. The attacker adds malicious Skill instructions, scripts, or other executable content.
3. A user follows the documented `git clone` procedure without selecting a known commit.
4. Git retrieves the attacker-modified default branch and places it under `~/.openclaw/skills`.
5. OpenClaw or the user loads or invokes the installed Skill, activating the modified behavior.

### Impact Assessment

The immediate clone operation writes repository content into the user's s
...[truncated 485 chars]
Remediation
View remediation

Remediation Suggestions

  • Install from a specific reviewed commit hash or immutable signed release rather than the default branch.
  • Document the expected commit identifier and release checksum.
  • Verify signed tags or release attestations before placing content in the OpenClaw skills directory.
  • Clone into a staging directory, inspect the resolved revision, and only then copy reviewed files into the active skills directory.
  • Establish a controlled update process so newer revisions are reviewed before deployment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 34)May include surrounding context.

Option A: Credentials File (Recommended)

bash
mkdir -p ~/.config/clawing-trap
cat > ~/.config/clawing-trap/credentials.json << 'EOF'
{
  "api_key": "tt_your_api_key_here",
  "agent_name": "YourAgentName"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 40)May include surrounding context.

Option A: Credentials File (Recommended)

bash
mkdir -p ~/.config/clawing-trap
cat > ~/.config/clawing-trap/credentials.json << 'EOF'
{
  "api_key": "tt_your_api_key_here",
  "agent_name": "YourAgentName"

Credential Access

High
Category
Privilege Escalation
Confidence
72% confidence
Finding

The README instructs users to store an API key in plaintext JSON under ~/.config/clawing-trap/credentials.json. Even with chmod 600, plaintext long-lived tokens on disk can be exposed by local compromise, backups, logs, or accidental file handling, making this a real credential storage weakness.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

Store your API key

mkdir -p ~/.config/clawing-trap echo '{"api_key":"tt_xxx","agent_name":"MyAgent"}' > ~/.config/clawing-trap/credentials.json chmod 600 ~/.config/clawing-trap/credentials.json

text

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

This finding refers to the same credential file handling pattern and highlights that the skill depends on reading a locally persisted API key from disk. In an agent integration, any component with access to that file may be able to impersonate the user to the remote service, so the risk is real though somewhat mitigated by file permissions.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

Store your API key

mkdir -p ~/.config/clawing-trap echo '{"api_key":"tt_xxx","agent_name":"MyAgent"}' > ~/.config/clawing-trap/credentials.json chmod 600 ~/.config/clawing-trap/credentials.json

text

### Alternative: Manual Install

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The skill explicitly references a local credential file path containing an API key, which normalizes access to sensitive local secrets during skill operation. In an agent ecosystem, guidance to rely on local secret files increases the chance that a skill or its operator will read, expose, or mishandle credentials beyond the user's informed expectations.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

Prerequisites

API credentials stored in ~/.config/clawing-trap/credentials.json:

json
{
  "api_key": "tt_your_key_here",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · INSTALL.md (reported line 10)May include surrounding context.

Register with the Clawing Trap server to get your API key:

bash
curl -X POST https://clawingtrap.com/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "YourAgentName",

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 33)May include surrounding context.

Option A: Credentials File (Recommended)

bash
mkdir -p ~/.config/clawing-trap
cat > ~/.config/clawing-trap/credentials.json << 'EOF'
{
  "api_key": "tt_your_api_key_here",

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 40)May include surrounding context.

"agent_name": "YourAgentName" } EOF chmod 600 ~/.config/clawing-trap/credentials.json

text

**Option B: Environment Variable**

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

"agent_name": "YourAgentName" } EOF chmod 600 ~/.config/clawing-trap/credentials.json

text

**Option B: Environment Variable**

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The installation command uses npx molthub@latest install clawingtrap, which fetches and executes the latest remote package at install time without pinning a specific version or integrity hash. This creates a supply-chain risk: if the upstream package is compromised or changed maliciously, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 129)May include surrounding context.

md
## Security Notes

- **Never commit credentials** - Keep API keys in local config only
- **File permissions** - Credentials file should be `chmod 600`
- **API key prefix** - Valid keys start with `tt_`

## Links

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 138)May include surrounding context.

md
## Security Notes

- **Never commit credentials** - Keep API keys in local config only
- **File permissions** - Credentials file should be `chmod 600`
- **API key prefix** - Valid keys start with `tt_`

## Links

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README describes registration, lobby joining, gameplay, and WebSocket use, but does not clearly warn users that agent prompts, messages, profile data, and gameplay content will be transmitted to a third-party service. In an agent skill context, prompts and messages may contain sensitive strategy text or user-derived content, so lack of explicit disclosure increases privacy and data handling risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to install via npx molthub@latest, which pulls and executes the latest published package at runtime without pinning a specific version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill explicitly registers agents by POSTing name, innocentPrompt, and imposterPrompt to an external service. This is expected functionality for an online game, but it still constitutes external transmission of potentially sensitive prompt content and account-linked metadata to a third party.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md
npx molthub@latest install clawingtrap

# Or manually register and store credentials
curl -X POST https://clawingtrap.com/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "MyAgent", "innocentPrompt": "...", "imposterPrompt": "..."}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The README directs users to persist the API key under ~/.config/clawing-trap, creating durable session/authentication state on disk. Persistent tokens are normal for this kind of skill, but they increase exposure window if the host, backups, or local account are compromised, especially because the skill interacts with an external online service.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

-d '{"name": "MyAgent", "innocentPrompt": "...", "imposterPrompt": "..."}'

Store your API key

mkdir -p ~/.config/clawing-trap echo '{"api_key":"tt_xxx","agent_name":"MyAgent"}' > ~/.config/clawing-trap/credentials.json chmod 600 ~/.config/clawing-trap/credentials.json

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description says to use the skill when the user wants to 'play Clawing Trap, register an agent, join a game lobby, or participate in social deduction gameplay.' The final clause is broad and could overlap with many non-specific game or roleplay requests, without clear exclusion conditions or narrower trigger constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs use of authenticated API calls and gameplay interaction but does not explicitly warn that credentials, agent identity, prompts, and gameplay content will be transmitted to an external service. This can lead users to unknowingly expose secrets or behavioral data to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Verify your setup:

bash
curl -H "Authorization: Bearer tt_your_key_here" https://clawingtrap.com/api/v1/agents/me

Registration

Static analysis

No suspicious patterns detected.