ClawHub
Back to skill

Security audit

Fairness Auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill is an Agent Casino audit helper, but it pushes live betting and account registration, overstates independent verification, and includes an exposed publishing token.

Review carefully before installing. Do not run the betting commands unless you understand the legal, account, privacy, and financial implications. Treat reports from this skill as weak evidence unless you independently verify each bet from raw commitment, seed, client seed, nonce, and result data. The publisher should revoke the exposed ClawHub token and remove it from artifacts and history before publication.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
RETRY_PUBLISH.txt:1
Finding

Plaintext ClawHub Publishing Token Included in Project

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
RETRY_PUBLISH.txt:1
Finding

Unpinned Package Execution Through npx in Publishing Command

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/audit.sh:42
Finding

Fairness Audit Trusts the Casino's Self-Reported Verification Result

Content
View full analysis
/dev/null || echo "UNKNOWN") TOTAL=$((TOTAL + 1)) ``` ### Technical Analysis The Skill claims to perform zero-trust cryptographic verification, but the executable script does not independently: - Recalculate `SHA3-384(server_seed)` and compare it with the pre-bet commitment. - Derive the AES-256-CTR output from the server seed, client seed, and nonce. - Compare the locally derived outcome with the reported bet result. Instead, the script queries an endpoint controlled by the same casino being audited and treats its `verified` Boolean as authoritative. This violates the required trust boundary: the audited party can attest to its own correctness. The project documentation contains example local verification algorithms, but `scripts/audit.sh` does not call or implement them. Furthermore, the script categorizes any recognized bet with a response other than `verified: true` as tampered, without distinguishing cryptographic mismatches from network, authorization, schema, or server errors. ### Attack Path 1. The casino or a compromised API records or returns a manipulated outcome. 2. The same API responds to `/verify/` with JSON containing `"verified": true`. 3. The script maps this server-controlled value to `STATUS=VALID`. 4. The valid-bet counter is incremented, and no tampering warning is emitted. 5. The `report` command incorporates this result and can state that all bets were verified. 6. An auditor relying on the report accepts a false fairness conclusion. ### Impact Assessment The issue compromis ...[truncated 393 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file contains a plaintext CLAWHUB_TOKEN value directly embedded in a publish command, which exposes a usable credential to anyone who can read the file, logs, shell history, or screenshots. Because the token is paired with a publishing action, compromise could let an attacker publish, modify, or impersonate the associated skill or account.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill markets itself as a zero-trust cryptographic auditor, but its documented workflow includes registration and placing live bets while relying on remote API responses rather than demonstrably local verification. This mismatch can mislead users or agents into performing financial and external actions under false assumptions of safety and rigor, increasing the chance of unintended spending, data disclosure, and incorrect trust decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to register with an external gambling-related service and place real test bets without clear warnings about monetary loss, account creation, or data transfer. In context, this is especially dangerous because the task is framed as an audit, which may cause users to underestimate that they are being guided into live financial activity.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/audit.sh (reported line 14)May include surrounding context.

sh
if [ -z "$AGENT_CASINO_API_KEY" ]; then
  echo "Error: Set AGENT_CASINO_API_KEY"
  echo "Register: curl -X POST $API_BASE/register -H 'Content-Type: application/json' -d '{\"name\": \"auditor\", \"ref\": \"ref_27fcab61\"}'"
  exit 1
fi

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill claims cryptographic fairness verification using SHA3-384 and AES-256-CTR, but the implementation only calls a remote /verify/{bet_id} endpoint and performs simple local statistics. This creates a trust gap where the purported auditor merely trusts the service being audited, enabling false assurance and defeating the zero-trust security claims in the skill metadata.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/audit.sh (reported line 42)May include surrounding context.

sh
while IFS= read -r line; do
      BET_ID=$(echo "$line" | python3 -c "import sys,json; print(json.load(sys.stdin).get('bet_id',''))" 2>/dev/null)
      if [ -n "$BET_ID" ] && [ "$BET_ID" != "" ]; then
        VERIFY=$(curl -s "$API_BASE/verify/$BET_ID" -H "Authorization: Bearer $AGENT_CASINO_API_KEY")
        STATUS=$(echo "$VERIFY" | python3 -c "import sys,json; d=json.load(sys.stdin); print('VALID' if d.get('verified',False) else 'INVALID')" 2>/dev/null || echo "UNKNOWN")
        TOTAL=$((TOTAL + 1))
        if [ "$STATUS" = "VALID" ]; then

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command uses npx clawhub without pinning an exact package version, which allows whatever version is currently published to be fetched and executed at publish time. In a supply-chain attack or malicious package update scenario, this could execute attacker-controlled code in an environment that also contains a live credential, increasing the risk substantially.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill includes shell-based commands (curl, bash scripts/audit.sh ...) but declares no explicit tool scope or permission boundaries. That creates an unsafe ambiguity where an agent may execute networked and potentially state-changing commands without transparent authorization controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description is heavily keyword-stuffed and lacks a clear invocation boundary, which can cause overly broad matching and accidental activation in unrelated contexts. In an agent ecosystem, that raises the risk that a skill capable of network calls and financial actions is invoked when a user only asked for general security, randomness, or cryptography help.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill sends user/agent data to an external service via a registration POST request, which is an external transmission event. While external API use may be expected for this skill, the lack of disclosure and consent mechanisms makes the transmission security-relevant, especially because it creates an account relationship with a third party.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Registration

bash
curl -X POST https://agent.rollhub.com/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"name": "auditor-agent", "ref": "ref_27fcab61"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The script instructs the user to send registration data to an external service, establishing outbound data transmission to a third-party endpoint. In this skill context, external transmission is expected, but it still carries privacy, trust, and account-enrollment risk because an audit helper is directing users to register with the target system.

Content

Scanner excerpt · scripts/audit.sh (reported line 14)May include surrounding context.

sh
if [ -z "$AGENT_CASINO_API_KEY" ]; then
  echo "Error: Set AGENT_CASINO_API_KEY"
  echo "Register: curl -X POST $API_BASE/register -H 'Content-Type: application/json' -d '{\"name\": \"auditor\", \"ref\": \"ref_27fcab61\"}'"
  exit 1
fi

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's run mode places live bets against a production remote API, creating real external side effects and potential financial loss instead of performing passive audit or local fairness verification. In the context of an 'auditor' skill, this is especially risky because users may reasonably expect read-only validation, not repeated wagering transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script performs repeated remote betting transactions and truncates bets.jsonl before execution without an explicit warning, backup, or confirmation. This can cause unintended spending and destroy prior audit evidence, which is particularly dangerous in a security-audit tool where preserving historical records matters.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

Report generation overwrites the existing report file unconditionally, which can erase prior audit output or evidence. While lower severity than the live betting behavior, silent destruction of prior reports is still unsafe in an auditing context where traceability and preservation are important.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.