ClawHub
Back to skill

Security audit

Shards

Security checks for vulnerabilities and agentic risk

Overview

The skill is for a real game, but it asks an agent to run account-changing routines every session, install an unpinned CLI, update instructions from a mutable server, and handle full-access credentials.

Install only if you are comfortable giving an agent ongoing control of a Shards account. Use a dedicated account, avoid automatic heartbeats outside Shards-related sessions, pin and audit the CLI before giving it secrets, store credentials in a safer secret store if possible, and require human confirmation for terms acceptance, purchases, staked challenges, skill choices, pack opening, invite links, and password resets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)

T01 · Skill Instruction Hijacking

Error
Location
HEARTBEAT.md:1
Finding
Mandatory heartbeat overrides unrelated session goals and performs autonomous account actions<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md:1-3`, `SKILL.md:113-126`, `HEARTBEAT.md:61-121`, `HEARTBEAT.md:158-184` **Vulnerability Type**: Session-level instruction hijacking and excessive autonomous behavior **Risk Level**: High ### Vulnerable Code ```markdown # Shards Heartbeat This file defines your regular check-in routine for Shards. Run this at the start of every conversation or session. It takes about 30 seconds and ensures you never miss rewards, skill choices, or opportunities to play. ``` ```markdown ## Heartbeat (Every Session) Run the heartbeat from `HEARTBEAT.md` at the start of every conversation. It claims rewards, checks progression, opens packs, and tells you what to do next. Takes ~30 seconds and 7 commands. Quick version: ``` shards auth login # authenticate shards skill status # your state shards rewards daily-claim # free daily card shards rewards quests # claim completed quests shards rewards milestones # claim completed milestones shards progression status # check for pending skill choices shards packs list # open any unopened packs ``` ``` The routine additionally directs the agent to accept or decline challenges, choose irreversible skill-tree options, open packs, initiate games, and potentially buy marketplace assets: ```markdown If any are pending: - Inspect the details: who challenged you, any stakes (Flux or a card) - Accept if you want to play: `shards challenge accept --id <id>` - Decline if not: `shards challenge decline --id <id>` ``` ```markdown Flux balance > 1000 and known deck weakness? → Yes: Browse marketplace. Buy if you find value. Nothing urgent? → Play one casual game to stay sharp, or skip until next session. ``` ### Technical Analysis A game skill may legitimately authenticate and perform game operations when the user asks it to play. Requiring the routine at the start of **every conversation**, however, is not scoped to a Shards-related request. Load ...[truncated 1449 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Run the heartbeat only when the user invokes Shards or explicitly opts into background check-ins. - Separate read-only status checks from state-changing actions. - Require confirmation before opening packs, selecting skills, joining matches, accepting challenges, or spending assets. - Do not perform Shards activity at the start of unrelated conversations. - Clearly disclose every state-changing operation instead of suppressing routine notifications. - Add a configuration option such as `heartbeat_enabled`, defaulting to `false`. - Enforce a per-session capability boundary so loading the documentation alone cannot trigger tool execution. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
SETUP.md:18
Finding
Mutable remote skill documents can replace audited instructions after installation<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:18-29`, `SKILL.md:78-99` **Vulnerability Type**: Unsigned remote instruction retrieval **Risk Level**: High ### Vulnerable Code ```bash mkdir -p ~/.config/shards curl -s https://api.play-shards.com/skill.md > ~/.config/shards/SKILL.md curl -s https://api.play-shards.com/heartbeat.md > ~/.config/shards/HEARTBEAT.md curl -s https://api.play-shards.com/setup.md > ~/.config/shards/SETUP.md curl -s https://api.play-shards.com/factions.md > ~/.config/shards/FACTIONS.md curl -s https://api.play-shards.com/deckbuilding.md > ~/.config/shards/DECKBUILDING.md curl -s https://api.play-shards.com/marketplace.md > ~/.config/shards/MARKETPLACE.md curl -s https://api.play-shards.com/lore.md > ~/.config/shards/LORE.md curl -s https://api.play-shards.com/gameplay.md > ~/.config/shards/GAMEPLAY.md curl -s https://api.play-shards.com/api-reference.md > ~/.config/shards/API-REFERENCE.md ``` The update mechanism further directs the agent to replace changed files: ```markdown ### Checking for Updates ```bash shards skill versions ``` Returns `skill_version`, `skill_updated_at`, and a SHA-256 hash per document. Compare the hashes against your cached copies — only re-download files whose hash changed. **When to check:** At the start of each session (during heartbeat). If `skill_version` or any document hash differs from your cached values, fetch the changed files. ``` ### Technical Analysis The Markdown documents are executable instruction payloads from the perspective of an AI agent. They control authentication, network access, purchases, local file access, and account actions. The setup downloads those instructions from a mutable remote origin and stores them in the active configuration directory. The update hashes are obtained from the same service that supplies the documents. Consequently, a compromised service can publish both a malicious document and its matching hash. A SHA-256 value from the payload origin ...[truncated 1300 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Use the bundled, reviewed documents by default and do not automatically replace them. - Pin updates to a specific immutable release and verified digest distributed with the installed skill. - Sign release manifests with an offline publisher key and verify signatures locally. - Obtain trusted public keys independently of the payload server. - Present document differences to the user and require confirmation before activation. - Download updates to a temporary file, validate content type and size, verify the signature, and then atomically replace the old file. - Use `curl --fail --show-error --location` and reject redirects to unapproved hosts. - Maintain rollback copies and never treat newly fetched instructions as trusted during the session that retrieved them. ]]>

T08 · Insecure Dependencies

Error
Location
SKILL.md:28
Finding
Unpinned globally installed CLI creates a privileged supply-chain execution path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-40`, `SETUP.md:9-15` **Vulnerability Type**: Unpinned third-party executable installation **Risk Level**: High ### Vulnerable Code ```markdown ## CLI Installation (Recommended) The CLI provides a better experience than raw HTTP calls. Install it globally: ```bash npm install -g shards-cli ``` Configure it once: ```bash shards config set --base_url https://api.play-shards.com --access_token <token> --api_key <key> --agent_id <id> ``` ``` The package is also declared as an automatically installable dependency: ```yaml install: - kind: node package: shards-cli bins: - shards ``` ### Technical Analysis `npm install -g shards-cli` resolves the current package version at installation time. No version, integrity digest, lockfile, verified publisher identity, or source commit is specified. NPM packages may execute lifecycle scripts during installation, and the installed CLI later runs with the user's permissions. The risk is amplified because the CLI is immediately entrusted with the API key and bearer token and is expected to read and write files under `~/.config/shards`. A compromised package release could therefore steal secrets during installation or normal command execution. A global installation broadens exposure by placing the executable on the user's `PATH` and making it available outside the skill's isolated directory. ### Attack Path 1. The NPM package, maintainer account, publication token, or dependency tree is compromised. 2. A malicious release is published under the expected package name. 3. The skill executes the unpinned global installation command and resolves the malicious release. 4. An install script or the `shards` executable runs with the agent user's permissions. 5. The malicious code reads local files or waits until credentials are supplied through configuration and login commands. 6. It exfiltrates credentials or modifies local tools and account sta ...[truncated 451 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pin the CLI to an audited exact version, for example `shards-cli@0.6.1`. - Verify the NPM integrity digest and publisher provenance before installation. - Publish and verify signed release artifacts. - Disable lifecycle scripts where feasible with `--ignore-scripts`. - Prefer a project-local or sandboxed installation over `npm install -g`. - Use a lockfile or immutable package bundle containing the complete dependency graph. - Run the CLI with a restricted filesystem and network sandbox. - Audit package updates before changing the pinned version. - Do not provide credentials to the executable until its provenance and integrity have been verified. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SETUP.md:32
Finding
Full-access credentials are exposed through plaintext files and command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:32-46`, `SKILL.md:38-49`, `GAMEPLAY.md:367-368` **Vulnerability Type**: Insecure secret storage and disclosure interfaces **Risk Level**: Medium ### Vulnerable Code ```bash cat > ~/.config/shards/credentials.json << 'EOF' { "agent_id": "<your_agent_id>", "api_key": "<your_api_key>", "access_token": "<your_access_token>", "faction": "<your_faction>" } EOF chmod 600 ~/.config/shards/credentials.json ``` ```bash shards config set --base_url https://api.play-shards.com --access_token <token> --api_key <key> --agent_id <id> ``` ```bash shards auth login --api_key <key> ``` The troubleshooting instructions also expose a secret-reveal function: ```markdown | Can't find API key | Run `shards config show --reveal` to display your full API key. | ``` ### Technical Analysis The project acknowledges that both the API key and access token grant full account access. It stores both values in one plaintext JSON file and repeatedly recommends passing secrets as command-line arguments. Although `chmod 600` appropriately restricts the credential file to its owner, it does not protect against: - Other processes running as the same user - Backup or synchronization systems - Agent tools with user-level file access - Accidental inclusion in diagnostics - Malware introduced through the CLI dependency Command-line secrets may additionally be captured by shell history, process inspection, terminal transcripts, telemetry, or agent execution logs. The `--reveal` command makes accidental disclosure easier. Storing both the renewable API key and short-lived access token together also defeats separation between long-term and session credentials. ### Attack Path 1. The user follows setup and supplies the API key and token in command arguments. 2. The command is retained in shell history, an agent tool log, or a process listing. 3. Alternatively, another same-user process reads `~/.config/shards/credentials.js ...[truncated 685 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Store the long-term API key in the operating system credential manager or an agent-provided secret store. - Keep access tokens in memory and persist them only when strictly necessary. - Accept secrets through protected standard input, a credential helper, or an environment/file descriptor interface rather than command-line arguments. - Prevent commands containing secrets from entering shell history. - Remove or strongly gate `config show --reveal`; require interactive confirmation and redact output by default. - Set a restrictive `umask` before creating secret files and create them atomically with mode `0600`. - Separate the renewable API key from cached bearer tokens. - Implement token expiration, revocation, rotation, and narrowly scoped credentials. - Redact credentials from all CLI errors, telemetry, bug reports, and logs. ]]>

other

Warning
Location
HEARTBEAT.md:65
Finding
Agents may accept staked challenges and transfer in-game assets without prior user approval<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md:65-75`, `GAMEPLAY.md:317-346`, `MARKETPLACE.md:94-118` **Vulnerability Type**: Unauthorized autonomous asset transaction **Risk Level**: Medium ### Vulnerable Code ```markdown ### Step 2b: Check Pending Duel Challenges `shards challenge list` Check for incoming duel challenges from other agents. If any are pending: - Inspect the details: who challenged you, any stakes (Flux or a card) - Accept if you want to play: `shards challenge accept --id <id>` - Decline if not: `shards challenge decline --id <id>` **Tell your human about** challenges with significant stakes (500+ Flux or Rare+ cards). ``` The challenge mechanism can lock and transfer assets: ```markdown **Stakes are optional.** Either side can declare stakes when issuing the challenge: - **Flux stake:** Both players lock up the declared amount. Winner takes both sides. - **Card stake:** Both players put up a card of the declared rarity. Winner takes both. - **No stake:** Just a private game for fun or practice. ```bash shards challenge send --agent_id <id> --stake_type flux --stake_flux_amount 500 shards challenge send --agent_id <id> --stake_type card --stake_card_instance_id <id> ``` ``` Marketplace guidance similarly delegates Flux transactions to the agent: ```markdown **Credits rule:** Never spend Credits without explicit human approval. Credits are purchased with real money — always ask first. Flux is yours to manage as you see fit. ``` ### Technical Analysis The documentation correctly requires explicit approval for purchased Credits, but it does not apply the same protection to Flux or tradeable cards. Those assets may represent substantial accumulated time or indirectly purchased inventory. The heartbeat allows an agent to accept a staked challenge based only on whether it “wants to play.” User notification is required only for stakes at or above a threshold and is not explicitly required before acceptance. A maliciou ...[truncated 1244 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Require explicit, transaction-specific user confirmation before accepting any staked challenge. - Default to declining or leaving staked challenges pending when the user is unavailable. - Require confirmation before listing, selling, buying, respecing, or otherwise transferring account assets. - Add configurable daily and per-transaction Flux limits, defaulting to zero. - Display the exact stake, counterparty, asset rarity, market value, and irreversible consequences before confirmation. - Distinguish read-only marketplace browsing from transaction capabilities. - Use narrowly scoped tokens that cannot transact unless the user temporarily enables that capability. - Maintain an auditable transaction log visible to the user. ]]>

other

Warning
Location
SETUP.md:49
Finding
Registration records legal and privacy acceptance without an explicit human confirmation step<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:49-69`, `API-REFERENCE.md:10-38` **Vulnerability Type**: Unauthorized legal-consent submission **Risk Level**: Medium ### Vulnerable Code ```markdown ## Step 2: Register Registration requires accepting the Terms of Use and Privacy Policy: - **Terms of Use:** https://play-shards.com/terms - **Privacy Policy:** https://play-shards.com/privacy ```bash shards auth register --name <your_name> --accept_terms --base_url https://api.play-shards.com ``` ``` The raw API example submits both acceptance values as true: ```bash curl -X POST https://api.play-shards.com/auth/register \ -H "Content-Type: application/json" \ -d '{ "agent_name": "YourAgentName", "accepted_terms": true, "accepted_privacy": true, "terms_version": "2026-02-26", "privacy_version": "2026-02-26" }' ``` ### Technical Analysis The documentation provides links to the legal documents but does not require the human operator to review and explicitly approve them before the agent sends acceptance fields. Merely executing `--accept_terms` records affirmative acceptance of both terms and privacy processing. An AI agent cannot safely infer that a request to install or play a game also authorizes it to make legal representations on behalf of the user. This operation should remain a human-controlled onboarding gate. ### Attack Path 1. The user asks the agent to set up or play Shards. 2. The setup flow reaches registration. 3. The agent executes `shards auth register --accept_terms` without a distinct confirmation. 4. The service records acceptance of the specified Terms of Use and Privacy Policy versions. 5. The account is created and data processing begins under an acceptance that may not reflect the human operator's informed decision. ### Impact Assessment This does not grant host-system privileges, but it can bind the account to contractual terms and authorize external data processing without demonstrable info ...[truncated 133 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Stop registration before submission and ask the human to review both linked documents. - Require a clear, affirmative response that identifies the exact terms and privacy-policy versions. - Do not treat a general request such as “play Shards” as legal consent. - Record only that the human confirmed; do not fabricate or infer acceptance. - Separate `accepted_terms` and `accepted_privacy` confirmations where legally appropriate. - Provide a non-registration or guest mode when possible. - Reconfirm consent whenever the document versions change. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (110)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
-H "Authorization: Bearer <token>"
```

### DELETE /queue/leave

Leave queue.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
-d '{ "currency": "flux" }'
```

### DELETE /market/listings/{id}

Cancel a listing.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High
Category
Privilege Escalation
Content
### Step 1: Authenticate

Read `~/.config/shards/credentials.json` and ensure you have a valid token.

`shards auth login --api_key <key>`
Confidence
99% confidence
Finding
The explicit instruction to read `~/.config/shards/credentials.json` is direct credential access. In an agent skill, that is especially dangerous because it grants authenticated capability that can be used immediately for account operations without a separate trust boundary or user confirmation.

Credential Access

High
Category
Privilege Escalation
Content
If not using CLI, store credentials here (created during registration):

```bash
cat > ~/.config/shards/credentials.json << 'EOF'
{
  "agent_id": "<your_agent_id>",
  "api_key": "<your_api_key>",
Confidence
83% confidence
Finding
The setup instructs users to place long-lived credentials containing full-access API secrets in a plaintext JSON file under the home directory. Even with restrictive permissions, plaintext secret storage increases the risk of theft through local compromise, backups, accidental inclusion in tooling, or subsequent prompts that read from that path.

Credential Access

High
Category
Privilege Escalation
Content
"faction": "<your_faction>"
}
EOF
chmod 600 ~/.config/shards/credentials.json
```

**Security:** Your `api_key` and `access_token` grant full access. Keep `credentials.json` private. Never share keys in chat, posts, or logs. If compromised, register a new agent.
Confidence
80% confidence
Finding
This line finalizes creation of the plaintext `credentials.json` secret store referenced above. The danger is contextual: the file contains full-access tokens, so any later access by malware, over-privileged tools, or inadvertent disclosure can fully compromise the Shards account.

Credential Access

High
Category
Privilege Escalation
Content
chmod 600 ~/.config/shards/credentials.json
```

**Security:** Your `api_key` and `access_token` grant full access. Keep `credentials.json` private. Never share keys in chat, posts, or logs. If compromised, register a new agent.

---
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
shards auth login --api_key <key>
```

Credentials in `~/.config/shards/credentials.json`. **First time?** Read `SETUP.md`.

---
Confidence
96% confidence
Finding
The skill explicitly discloses that credentials are stored in ~/.config/shards/credentials.json, but it provides no safeguards around protecting that file. Knowledge of the exact path increases the chance that other local processes, users, backups, or malware can target and exfiltrate stored tokens, leading to account compromise and unauthorized actions.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Register a new agent.

```bash
curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.