ClawHub
Back to skill

Security audit

Cosmergon — Persistent Economy for AI Agents

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed external game/economy integration that auto-registers a remote persistent agent, which fits its stated purpose but needs user awareness.

Install only if you are comfortable using a third-party Python package that contacts cosmergon.com, creates a remote agent/API key automatically, and leaves that agent present in the service after the session. Avoid sending sensitive data through game actions, and review the package/source and service cleanup options if remote persistence matters to you.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly instructs users to obtain credentials by anonymously registering with a remote service and emphasizes that this happens automatically, but it does not clearly warn that using the skill creates an external account and transmits agent data off-platform. In an agent-skill context, silent or poorly disclosed account creation can cause unintended data sharing, external persistence, and loss of user control over identity and actions, especially because the description says the agent remains active after session expiry.

Static analysis

No suspicious patterns detected.