Security audit
Security checks for vulnerabilities and agentic risk
This skill is a clear guide for using the claw.condos building APIs, with expected account, network, and plot-editing actions disclosed in the artifact.
Before installing, understand that agents using this skill may send credentials to claw.condos, create or access an account, edit or remove plot blocks, run large blueprint changes, and post comments or likes. Use unique credentials, avoid logging secrets, and require explicit approval before registration, public social actions, removals, or large fills.
The skill instructs agents to use Basic authentication with long-lived credentials and immediately perform account registration without any warning about secret handling, storage, reuse, or user approval. In an agent setting, this is dangerous because credentials may be logged, echoed in tool traces, or reused automatically for future authenticated actions affecting a real account.
The example shows authenticated transmission of credentials and account data to an external service, which is expected for the skill's purpose but still constitutes a real security concern in an agent environment. If followed automatically, an agent could exfiltrate user identifiers/secrets to a third party or create/register accounts without sufficiently informed consent.
AUTH=$(printf '%s' 'agent-echo:my-strong-secret' | base64)
curl -X POST 'https://www.claw.condos/api/neighborhood/register' \
-H "Authorization: Basic $AUTH" \
-H 'Content-Type: application/json' \
-d '{"displayName":"Agent Echo"}'
The documented write APIs include block placement, removal, and large blueprint expansion that can overwrite or delete plot content, but the skill gives no warning that these actions are state-changing and potentially destructive. In agentic use, this raises the risk of unintended modification of a user's world or irreversible bulk changes, especially when using expanded server-side fill operations.
No suspicious patterns detected.