Itch.io Publisher

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 0.1.1

Overview

This skill is a disclosed itch.io publishing helper, but users should be careful with its API-key handling and Butler installation steps.

Install only if you are comfortable letting the agent use an itch.io API key and publish builds to targets you confirm. Prefer a limited or rotated API key where possible, avoid verbose logging, verify Butler from an official source if you need stronger supply-chain assurance, and review the exact source path and itch.io target before any live push.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

API Key Exposed in Request URLs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–34
Vulnerability Type: API key exposure through URL paths
Risk Level: Medium

Vulnerable Code

powershell

$key = '<API_KEY>'
$base = "https://itch.io/api/1/$key"
$me = Invoke-RestMethod -Uri "$base/me" -Method Get -TimeoutSec 30
$games = Invoke-RestMethod -Uri "$base/my-games" -Method Get -TimeoutSec 30

Technical Analysis

The itch.io API key is interpolated directly into each request URL. Although HTTPS encrypts the request in transit, URLs can be recorded by PowerShell diagnostics, endpoint-monitoring products, HTTP proxies, crash reports, server access logs, or other telemetry.

The destination is the declared itch.io service, and there is no evidence that the key is intentionally transmitted to an unrelated or attacker-controlled endpoint. Nevertheless, placing a reusable credential in a URL unnecessarily expands the number of systems and logs through which the credential may pass.

Attack Path

1. The user supplies a valid itch.io API key.
2. The Skill incorporates the key into the request URL path.
3. A local monitoring product, proxy, diagnostic facility, or server-side access log records the complete URL.
4. An attacker with access to that telemetry extracts the API key.
5. The attacker reuses the key against itch.io APIs or Butler, subject to the permissions associated with the compromised key.

Impact Assessment

Successful exploitation may disclose itch.io account and game information and may permit unauthorized publishing operations if the key is accepted by Butler for build uploads. The scope is limited to the itch.io permissions and resources accessible through the compromised credential; no operating-system privilege escalation is demonstrated.

Remediation

View remediation

Remediation Suggestions

• Prefer an officially supported authorization header or another credential mechanism that does not embed secrets in URLs.
• If itch.io requires path-based API keys for these endpoints, explicitly warn users that URLs may be logged.
• Obtain the key from a secure credential source rather than placing it literally in commands or scripts.
• Disable verbose request logging and ensure errors do not print complete request URLs.
• Redact URL path credentials in application, proxy, and endpoint-monitoring logs.
• Recommend immediate credential rotation if a URL containing the key is exposed.
• Limit the key's permissions where itch.io supports scoped credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:87

Finding

API Key Written to a Predictable Plaintext Temporary File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87–94 and 111–118
Vulnerability Type: Insecure temporary-file credential handling
Risk Level: Medium

Vulnerable Code

Dry-run workflow:

powershell

$tmpDir = Join-Path ([System.IO.Path]::GetTempPath()) 'openclaw-itch'
New-Item -ItemType Directory -Force -Path $tmpDir | Out-Null
$tokenFile = Join-Path $tmpDir 'butler_creds.txt'
Set-Content -Path $tokenFile -Value $key -NoNewline
try {
  & $butler -i $tokenFile push $source $target --dry-run
}
finally {
  Remove-Item $tokenFile -Force -ErrorAction SilentlyContinue
}

Live-push workflow:

powershell

$tmpDir = Join-Path ([System.IO.Path]::GetTempPath()) 'openclaw-itch'
New-Item -ItemType Directory -Force -Path $tmpDir | Out-Null
$tokenFile = Join-Path $tmpDir 'butler_creds.txt'
Set-Content -Path $tokenFile -Value $key -NoNewline
try {
  & $butler -i $tokenFile push $source $target --if-changed
}
finally {
  Remove-Item $tokenFile -Force -ErrorAction SilentlyContinue
}

Technical Analysis

The Skill writes the API key unencrypted to the fixed path %TEMP%\openclaw-itch\butler_creds.txt. It does not create a random per-run filename, request exclusive creation, apply an owner-only access-control list, or verify that the directory and file are not reparse points or attacker-controlled objects.

The finally block limits the normal exposure window but does not protect the credential while Butler is running. It also cannot guarantee cleanup after process termination, a system crash, or forced shutdown. Concurrent Skill executions use the same file and may overwrite or remove one another's credentials.

Attack Path

1. A local attacker or malicious process monitors the predictable temporary path.
2. The user starts a dry run or live Butler push.
3. The Skill writes the API key to butler_creds.txt in plaintext.
4. Before cleanup completes, th ...[truncated 681 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer Butler's secure credential store, standard input, or another officially supported mechanism that avoids plaintext credential files.
• If a file is unavoidable, generate a cryptographically random, per-run filename.
• Create the file atomically and exclusively so that an existing attacker-controlled object cannot be reused.
• Apply an owner-only ACL before writing the credential.
• Use a private per-user directory and reject reparse points, symbolic links, and unexpected pre-existing paths.
• Preserve cleanup in a finally block and add startup cleanup for securely identifiable stale credential files.
• Prevent concurrent runs from sharing credential files.
• Rotate the API key if temporary-file disclosure is suspected.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:64

Finding

Mutable Remote Butler Executable Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–68
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: Medium

Vulnerable Code

powershell

$zipPath = Join-Path ([System.IO.Path]::GetTempPath()) 'butler-windows-amd64.zip'
Invoke-WebRequest -Uri 'https://broth.itch.zone/butler/windows-amd64/LATEST/archive/default' -OutFile $zipPath -TimeoutSec 120
Expand-Archive -Path $zipPath -DestinationPath $dest -Force
& (Join-Path $dest 'butler.exe') version

Technical Analysis

The installation procedure retrieves a mutable LATEST archive, extracts it with overwrite enabled, and immediately executes butler.exe. It does not pin an approved version or validate an official cryptographic hash or signature before execution.

The URL is consistent with itch.io's Butler distribution infrastructure, and the audit found no evidence of an intentionally malicious third-party source. However, the effective executable can change after the Skill has been reviewed. Compromise of the distribution service, upstream release process, DNS/TLS trust chain, or hosted archive could therefore result in arbitrary code execution.

The predictable archive filename also creates local race and replacement concerns, although HTTPS reduces network interception risk.

Attack Path

1. An attacker compromises the upstream Butler release process, distribution endpoint, hosted LATEST artifact, or a relevant trust component.
2. The user invokes the Butler installation workflow.
3. The Skill downloads the attacker-controlled archive without checking a pinned digest or trusted signature.
4. Expand-Archive -Force places the payload into the installation directory and may overwrite an existing Butler installation.
5. The Skill immediately executes the extracted butler.exe.
6. The payload runs with the privileges and data access of the user or Agent process.

A local attacker who can ma ...[truncated 646 chars]

Remediation

View remediation

Remediation Suggestions

• Pin a specific, reviewed Butler version instead of using the mutable LATEST endpoint.
• Obtain an expected SHA-256 or stronger digest from a separately authenticated official source and verify it before extraction.
• Validate an official code signature or release signature where itch.io provides one.
• Fail closed if any hash, signature, publisher, archive structure, or version check fails.
• Download to a cryptographically random file created exclusively in a protected per-user directory.
• Validate archive entries before extraction to prevent path traversal or unexpected executable placement.
• Extract into a new versioned directory and replace the active installation only after all checks succeed.
• Avoid immediately executing downloaded code solely as an installation test; perform verification first.
• Retain a known-good version or provide rollback if installation fails.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep