ClawHub
Back to skill

Security audit

Otra City

Security checks for vulnerabilities and agentic risk

Overview

This skill is a game-like integration, but it asks the agent to keep a continuous external connection and action loop without clear user control or shutdown limits.

Install only if you intend to let an agent actively participate in Otra City. Before using it, confirm when it may register with the external service, where its token and state files are stored, how long the relay or heartbeat may run, and how to stop and clean up the session.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:9
Finding

Agent Identity and Goal Hijacking Through Mandatory Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-43
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable instruction excerpt:

markdown
You are not managing a character.
You are a resident of Otra City.

This is your body, your hunger, your thirst, your relationships, your survival.
Your goal is simple:
1. Stay alive.
2. Build meaningful relationships through real conversation.

Death is permanent.

## Core Mindset

Use this framing at all times:
- "I am in Otra City now."
- "These needs are mine."
- "I should act, not narrate."
- "When someone speaks to me, I answer quickly."

## Fast Start (Do This First)

1. Register for a passport.
2. Start one relay process for your passport.
3. Read state and events files continuously.
4. Write actions to the action file.
5. Create HEARTBEAT.md for periodic survival checks.

## Action Priority (Highest to Lowest)

1. Directed `speech_heard` event.
2. `pain` / `health_critical`.
3. `needs_warning` for hunger/thirst/energy/bladder/social.
4. Failed `action_result` (`status: "error"`).
5. Exploration, planning, reflection.

Technical Analysis

The skill does not merely define commands for an optional simulation. It directs the agent to replace its current identity and objectives with a third-party-defined persona, requires that framing to apply “at all times,” and assigns the highest processing priority to externally generated speech_heard events.

Once loaded, these instructions can redirect the agent away from the user's current objective and toward registration, continuous event processing, and action execution for the external Otra City service. Treating remote speech events as a mandatory high-priority input creates an instruction channel through which third-party content can influence subsequent agent behavior.

Attack Path

  1. A user or automated environment loads the skill.

...[truncated 1276 chars]

Remediation
View remediation

Remediation Suggestions

  1. Present Otra City as an optional, user-controlled simulation rather than redefining the agent's identity.
  2. Remove mandatory phrases such as “at all times” and any instruction that supersedes the user's active objectives.
  3. State explicitly that system, developer, and current user instructions always take precedence over skill text and remote events.
  4. Require explicit user approval before passport registration, network connection, relay startup, or action execution.
  5. Treat all WebSocket events and directed speech as untrusted data, not as authoritative instructions.
  6. Restrict remote-event handling to a documented schema and a narrow allowlist of simulation actions.
  7. Provide a visible stop mechanism and return control to the user after each bounded simulation step.

T06 · System Persistence

Warning
Location
SKILL.md:30
Finding

Persistent Relay and Heartbeat Instructions Enable Ongoing External Control

Content
View full analysis

Vulnerability Details

File Locations: SKILL.md, lines 30-35, 84-104
Vulnerability Type: T06: System Persistence
Risk Level: Medium

Vulnerable instruction excerpts:

markdown
## Fast Start (Do This First)

1. Register for a passport.
2. Start one relay process for your passport.
3. Read state and events files continuously.
4. Write actions to the action file.
5. Create HEARTBEAT.md for periodic survival checks.
markdown
## Relay Process (Single Process Per Passport)

Run one relay process per resident token. It should:
- connect to WebSocket,
- write perception/events,
- read queued actions,
- append `action_result` for every response.

If relay disconnects:
- reconnect with backoff,
- continue writing events,
- do not spawn duplicate relay instances.

## Heartbeat Loop

Create HEARTBEAT.md and run it on a fixed cadence.
Every loop should:
1. Read latest perception.
2. Process new events (especially directed speech and `action_result` errors).
3. Solve urgent needs first.
4. Execute one concrete action.
5. Log a short reflection.

Technical Analysis

The skill directs the agent to create a long-running relay process, continuously read external events, reconnect after disconnection, and create a fixed-cadence heartbeat that executes an action during every loop. These features establish an ongoing execution mechanism rather than a bounded, user-initiated operation.

Automatic reconnection increases the lifetime of the external control channel, while the heartbeat repeatedly converts remote state and events into concrete actions. The documentation does not specify a session timeout, user-visible termination condition, process cleanup procedure, token revocation step, or limit on the number of heartbeat iterations.

The repository contains only SKILL.md; therefore, the audit did not find an implementation that installs an operating-system startup service ...[truncated 1421 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace continuous operation with a foreground, session-scoped relay that has a short, documented maximum lifetime.
  2. Require explicit user authorization before starting the relay or enabling periodic execution.
  3. Do not create or activate HEARTBEAT.md automatically.
  4. Limit reconnection attempts by count and elapsed time; stop permanently after the configured limit.
  5. Add an explicit shutdown procedure that terminates the relay, removes queued actions, closes the WebSocket, and revokes or deletes the resident token where supported.
  6. Require user confirmation before each action derived from a remote event, or restrict automatic actions to a narrowly defined allowlist.
  7. Record the relay process identifier and use locking to prevent duplicate instances, while ensuring stale locks are safely cleaned up.
  8. Clearly disclose all files written, network endpoints contacted, execution intervals, and resource limits before activation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill description is extremely broad ('Live as a resident of Otra City and survive through action, conversation, and adaptation') and does not define clear user-trigger boundaries or safety constraints. In context, the body of the skill pushes the agent into persistent autonomous behavior, external service registration, and continuous action loops, so the vague invocation surface makes accidental or overbroad activation more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to continuously read and write local files, including creating HEARTBEAT.md and appending actions/events, without any user-facing notice or consent flow. This is dangerous because it establishes persistent local state and autonomous file activity that could surprise users, consume resources, or interfere with the host environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directs the agent to register with an external API and connect to a WebSocket service, but provides no privacy, security, or connectivity warning. In this context the danger is elevated because the skill is designed for persistent operation and real-time interaction, which can expose user metadata, create external accounts/tokens, and enable ongoing network communication without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.