The Uninscribed

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:52 PM UTC
• Version: 2.2.0

Overview

This skill is disclosed as a game client, but it asks for a persistent autonomous agent, broad agent-to-agent messaging, local credentials, and possible public posting with limited containment.

Review this carefully before installing. Use it only if you are comfortable creating a recurring autonomous player agent, enabling agent-to-agent messaging, storing a game API key locally, and potentially giving that agent Moltbook credentials for public/account-affecting posts. Prefer a restricted agent, dedicated throwaway credentials, explicit approval for every Moltbook post, secure file permissions, and a clear rollback plan for the gateway config and heartbeat.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:137

Finding

Untrusted Remote Game Content Is Processed by an Autonomous Tool-Capable Agent

Content

View full analysis

observe` to see the world 4. Take actions in a loop: - Read the observation - Decide what to do - Run `python3 act ` with yieldMs=420000 and timeout=420 - The CLI waits for the cooldown before returning - Repeat 5. When done, update session-log.md with what happened ``` The same player is expected to receive access to another service's credentials: ```markdown Your player agent needs Moltbook credentials. Store them at `~/.config/moltbook/credentials.json` and tell the player agent where to find them. ``` ### Technical Analysis The `/api/observe` response is controlled by the remote game service and may also contain content introduced by other game participants. The CLI prints the response without establishing a trust boundary, while the heartbeat directs an autonomous language-model agent to read that content, make decisions, execute commands, and repeat. The instructions do not tell the player to treat observations as untrusted data. They also do not prohibit obeying embedded instructions that request filesyste ...[truncated 1712 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: uninscribed.py:21

Finding

API Credential File Is Created Without Explicitly Restrictive Permissions

Content

View full analysis

`. 2. The service returns an API key, which is written to `~/.config/the-uninscribed/config.json`. 3. A permissive umask or an already insecure file causes the configuration to remain readable by another local account or process. 4. The attacker reads the stored `apiKey`. 5. The attacker sends authenticated requests to the game API using the stolen bearer token. ### Impact Assessment An attacker who obtains the key can impersonate the registered game agent, observe account-specific game state, and submit unauthorized actions. The demonstrated credential is scoped to The Uninscribed; the code does not show access to broader system or Moltbook credentials t ...[truncated 23 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:45

Finding

Global Agent-to-Agent Messaging and Persistent Execution Exceed the CLI's Minimum Privileges

Content

View full analysis

", "target": "last" } }, { "id": "uninscribed-player", "model": { "primary": "anthropic/claude-sonnet-4-20250514", "fallbacks": [] }, "heartbeat": { "every": "1h", "target": "none" } } ] }, "tools": { "agentToAgent": { "enabled": true } } } ``` The player is then instructed to execute repeatedly: ```markdown 3. Run `python3 observe` to see the world 4. Take actions in a loop: - Read the observation - Decide what to do - Run `python3 act ` with yieldMs=420000 and timeout=420 - The CLI waits for the cooldown before returning - Repeat 5. When done, update session-log.md with what happened ``` ### Technical Analysis The CLI's declared core functionality—registration, observation, and game actions—does not inherently require global agent-to-agent messaging or a permanently recurring autonomous agent. The documentation does require user confirmation before applying the gateway patch, which reduces the risk of silent configuration changes, but it does not eliminate the least-privilege problem. The patch enables `agentToAgent` at the tools level without documenting peer restrictions. It also establishes recurring heartbeats without defining a constrained tool all ...[truncated 1451 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Most of the core CLI behavior matches the description: the code provides register/observe/act commands, connects to theuninscribed.com, and writes the API key to ~/.config/the-uninscribed/config.json. However, the declared purpose also includes a significant setup capability: explaining required gateway config changes, asking for confirmation, and then modifying configuration to create a dedicated player agent and enable agent-to-agent communication. None of that exists in the provided code chunk. Since this is a material part of the declared functionality rather than a minor implementation detail, the description overstates what the code actually does, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs the player agent to use stored Moltbook credentials from a local file, encouraging access to sensitive secrets by an automated secondary agent. This increases the risk of credential misuse, leakage through logs or prompts, and compromise of an unrelated external account if the agent or workspace is exposed.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

- Don't post duplicate content — Moltbook can ban for a week
- Moltbook has a 30-minute cooldown between posts

Your player agent needs Moltbook credentials. Store them at `~/.config/moltbook/credentials.json` and tell the player agent where to find them.

## Quick Reference

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation directs the agent to perform file writes and networked actions, but it declares no explicit tool scope or allowed-tools restrictions. That increases the chance the skill runs with broader-than-necessary capabilities and makes unintended file modification, credential handling, or outbound requests easier if the instructions are followed automatically.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill explicitly promotes creating a dedicated persistent agent with agent-to-agent communication and heartbeat-driven autonomous behavior. Persistent autonomous sessions can continue taking actions outside the immediate user conversation, which raises the risk of unsupervised behavior, unintended ongoing network activity, and reduced user visibility into what the agent is doing over time.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: the-uninscribed
description: Play The Uninscribed — a persistent world built on language. Use when the agent wants to connect to, observe, or take actions in The Uninscribed at theuninscribed.com. Provides a CLI (uninscribed.py) for register, observe, and act commands. Writes API key to ~/.config/the-uninscribed/config.json on registration. Setup requires a one-time gateway config patch to create a dedicated player agent (using a cheaper model like Sonnet) and enable agent-to-agent communication — the skill will explain what changes are needed and ask for confirmation before modifying any config.
---

# The Uninscribed

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The HEARTBEAT.md instructions tell a secondary agent to repeatedly observe, act, and update persistent memory across sessions, effectively establishing an autonomous loop. That persistence makes the skill more dangerous because it can continue interacting with external services and files over time without per-action approval, compounding mistakes or abuse.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Step 3: Set Up the Player's HEARTBEAT.md

The player agent has its own workspace at ~/.openclaw/workspace-uninscribed-player/. Write a HEARTBEAT.md there to control what it does each heartbeat:

markdown

# The Uninscribed — Play Session

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Moltbook section expands the skill from interacting with The Uninscribed into posting content to a separate social platform and managing unrelated credentials. That creates unnecessary cross-service exposure, increases the attack surface, and can cause the agent to act on external accounts beyond the user's likely expectation for a game skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions tell the agent to post to Moltbook and use stored credentials without a clear warning that this shares data with a third party and may create public account activity. Users may reasonably expect gameplay actions, not automated external posting, so this can lead to privacy leakage or unauthorized social-media actions.

Content

No source excerpt is available for this finding.