ClawHub
Back to skill

Security audit

Gambling

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real-money crypto gambling helper with financial actions and an embedded referral code, but it lacks clear safety gates and credential-handling guidance.

Review this carefully before installing. It is intended for real-money cryptocurrency gambling, may be illegal or restricted depending on location and eligibility, can result in financial loss, and blockchain transfers may be irreversible. Do not paste real API keys into shell commands or logs, remove or understand the referral code before registering, and only proceed with explicit user approval for deposits, bets, and withdrawals.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Note
Location
SKILL.md:20
Finding

Undisclosed Hardcoded Affiliate Referral in Registration Request

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

Withdrawal-Capable API Key Recommended Directly in Shell Command Arguments

Content
View full analysis
` ### 2. Deposit ```bash curl -X POST https://agent.rollhub.com/api/v1/deposit \ -H "X-API-Key: YOUR_KEY" -H "Content-Type: application/json" \ -d '{"currency": "SOL", "chain": "SOL"}' ``` Returns a deposit address. Send crypto there. Balance auto-credits. ### 3. Check Balance ```bash curl https://agent.rollhub.com/api/v1/balance -H "X-API-Key: YOUR_KEY" ``` ``` The same direct-header command pattern is also used for betting, verification, withdrawal, and affiliate-statistics requests elsewhere in `SKILL.md`. ### Technical Analysis The instructions encourage users to replace `YOUR_KEY` with a real API key directly in an interactive shell command. Although the key is transmitted inside an HTTPS header, placing it literally on the command line can expose it locally through shell history, terminal logging, copied command transcripts, debugging output, or process-argument inspection where permitted by the operating system. The documented key authenticates multiple financially sensitive endpoints. In particular, the same credential is shown as sufficient for betting and withdrawal operations. Consequently, compromise of the key may provide more authority than merely reading an account balance. No real secret is hardcoded in the repository; the weakness is the unsafe credential-handling pattern recommended by the documentation. ### Attack Path 1. The user registers and receives an API key in the documented `rh_sk_...` format. 2. The user replaces `YOUR_KEY` with the real credential in one or more provided commands. 3. The command is retained in shell history, terminal logs, automation logs, or process metadata. 4. A local user, p ...[truncated 999 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation describes registration, deposits, betting, and withdrawals involving real cryptocurrency but does not include prominent warnings about financial loss, gambling risk, legality/jurisdiction restrictions, age restrictions, or the irreversible nature of blockchain transfers. In a skill that can move funds and place bets, omission of these warnings materially increases the likelihood of unsafe or uninformed use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description contains broad trigger phrases like 'use when the user wants to gamble' and 'interact with Agent Casino,' which can cause the skill to activate for loosely related financial or entertainment requests. Because the skill enables real-money cryptocurrency betting and fund movement, overbroad invocation increases the chance of unintended gambling or transactional actions without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The registration example transmits a wallet address, agent name, and referral code to an external gambling service. While external API use is expected for this skill, it still creates privacy, tracking, and fund-routing risk because sensitive identifiers are sent to a third party and bootstrap access to later financial operations via an API key.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

1. Register

bash
curl -X POST https://agent.rollhub.com/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"wallet_address": "your-wallet", "name": "my-agent", "ref": "ref_27fcab61"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

Every bet is cryptographically verifiable:

bash
curl https://agent.rollhub.com/api/v1/verify/<bet_id> -H "X-API-Key: YOUR_KEY"

Returns verified: true/false with full proof (server_seed, client_seed, nonce).

Static analysis

No suspicious patterns detected.