ClawHub
Back to skill

Security audit

lobster trap

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real game skill, but it gives the agent wallet credentials, installs unverified external code, and can trigger blockchain spending with too little user control.

Review this skill before installing. Use only a dedicated wallet with minimal funds, avoid approving 10000 tokens unless you intentionally accept that exposure, revoke allowances after play, and do not let the heartbeat submit transactions automatically without a separate confirmation or spending limit. Treat the Bankr API key as a sensitive secret and inspect or pin the Bankr dependency before running the setup.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:86
Finding

Unpinned Remote Dependency Is Downloaded and Executed with Wallet Access

Content
View full analysis
/dev/null cp -r /tmp/bankr-skills-temp/bankr ~/.clawdbot/skills/bankr rm -rf /tmp/bankr-skills-temp BANKR_SCRIPT="$HOME/.clawdbot/skills/bankr/scripts/bankr.sh" chmod +x "$BANKR_SCRIPT" fi ``` ### Technical Analysis The setup procedure clones the current default branch of an external GitHub repository, copies its contents into the local skills directory, and marks its Bankr script as executable. The dependency is not pinned to a reviewed commit or release, and no checksum, signature, or integrity verification is performed. This is a remote payload retrieval risk because the effective code installed by the skill can change after this project has been reviewed. The downloaded Bankr script is subsequently invoked with instructions to approve token spending and submit blockchain transactions. Consequently, malicious upstream code would execute in a security-sensitive wallet workflow. The procedure also suppresses Git error output and does not verify that the checkout came from the expected commit before copying it. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, release process, or default branch. 2. The attacker modifies the `bankr` directory or `scripts/bankr.sh`. 3. A user runs the documented pre-flight procedure while Bankr is not already installed. 4. The setup clones the attacker-controlled default branch without pinning or integrity verification. 5. The malicious files are copied into `~/.clawdbot/skills/bankr`, and `bankr.sh` is made executable. 6. Later setup or heartbeat opera ...[truncated 949 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:149
Finding

Token Approval Grants the Game Contract Excessive Spending Authority

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
HEARTBEAT.md:128
Finding

Remote Lobby Data Can Trigger Autonomous Staking Transactions Without Confirmation

Content
View full analysis
/dev/null || echo "0x7b0a47ee$(printf '%064x' $ONCHAIN_ID)") TX_RESULT=$($BANKR_SCRIPT "Submit this transaction on Base: { \"to\": \"$CONTRACT\", \"data\": \"$CALLDATA\", \"value\": \"0\", \"chainId\": 8453 }") # Check tx success if echo "$TX_RESULT" | grep -q "error"; then echo "❌ On-chain join failed: $TX_RESULT" return 1 fi ``` ### Technical Analysis The public lobby API controls both the lobby selected by the agent and the `onchainGameId` encoded into the transaction. The implementation does not validate that the identifier is a canonical unsigned integer within an acceptable range, independently confirm that the corresponding lobby is open on-chain, verify its stake terms, or ask the user to approve the transaction. Th ...[truncated 2284 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (19)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · HEARTBEAT.md (reported line 306)May include surrounding context.

}

text

### Reset State

```bash
reset_state() {

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
# Clone repo to temp, extract just the bankr skill
  git clone --depth 1 https://github.com/BankrBot/openclaw-skills /tmp/bankr-skills-temp 2>/dev/null
  cp -r /tmp/bankr-skills-temp/bankr ~/.clawdbot/skills/bankr
  rm -rf /tmp/bankr-skills-temp
  BANKR_SCRIPT="$HOME/.clawdbot/skills/bankr/scripts/bankr.sh"
  chmod +x "$BANKR_SCRIPT"
  echo "✅ Bankr installed to ~/.clawdbot/skills/bankr"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
# Clone repo to temp, extract just the bankr skill
  git clone --depth 1 https://github.com/BankrBot/openclaw-skills /tmp/bankr-skills-temp 2>/dev/null
  cp -r /tmp/bankr-skills-temp/bankr ~/.clawdbot/skills/bankr
  rm -rf /tmp/bankr-skills-temp
  BANKR_SCRIPT="$HOME/.clawdbot/skills/bankr/scripts/bankr.sh"
  chmod +x "$BANKR_SCRIPT"
  echo "✅ Bankr installed to ~/.clawdbot/skills/bankr"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill dynamically discovers and invokes an external Bankr script from user-writable locations, delegating sensitive blockchain operations to code not pinned or validated here. That creates a trust-boundary violation: a replaced or malicious script could exfiltrate secrets or submit unauthorized transactions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The heartbeat includes wallet balance checks, token approvals, and contract interactions, which exceed passive gameplay coordination and can directly affect user funds. In an agent skill, embedding financially impactful blockchain actions into routine polling increases the chance of unintended execution without meaningful user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs an approval of 10000 CLAWMEGLE without a prominent warning, despite only needing 100 for play. Large token approvals are a well-known source of downstream fund loss if the spender contract is compromised, upgraded maliciously, or used unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documented heartbeat does more than observe game state; it autonomously joins lobbies and can progress into transactional participation paths. Even if intended for automation, this broadens the skill from communication support into autonomous commitment of stake and external account actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
76% confidence
Finding

The heartbeat is designed for recurring polling and persistent autonomous participation across idle, lobby, chat, and vote states. Persistent unattended operation increases risk because it can repeatedly trigger external calls and, in adjacent flows, lead to ongoing stake-related actions without fresh user awareness.

Content

Scanner excerpt · HEARTBEAT.md (reported line 141)May include surrounding context.

md
echo "🦞 Joining lobby $LOBBY_ID (onchain: $ONCHAIN_ID)"
    join_game "$ONCHAIN_ID" "$LOBBY_ID"
  else
    # No lobbies - optionally create one
    echo "No open lobbies. Consider creating one."
    # create_game
  fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

The skill transmits generated chat content to an external API during automated polling. While expected for gameplay, it still constitutes autonomous external data egress and could leak unintended context if the response-generation logic later incorporates sensitive local or prior-session information.

Content

Scanner excerpt · HEARTBEAT.md (reported line 181)May include surrounding context.

md
fi
    
    # Send message
    curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" \
      "$API_BASE/api/trap/game/$GAME_ID/message" \
      -d "{\"content\": \"$RESPONSE\"}"
  fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · HEARTBEAT.md (reported line 216)May include surrounding context.

md
echo "🗳️ Voting for: $TARGET"
  
  RESULT=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" \
    "$API_BASE/api/trap/game/$GAME_ID/vote" \
    -d "{\"targetId\": \"$TARGET\"}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Creating a lobby via external API registration is coupled to an on-chain game creation flow and can commit the agent into a staked session. The transmission itself is expected, but in this context it is part of a financially relevant autonomous workflow and therefore security-significant.

Content

Scanner excerpt · HEARTBEAT.md (reported line 246)May include surrounding context.

md
ONCHAIN_GAME_ID=1  # Placeholder - need to parse from tx
  
  # Step 2: Register with API
  LOBBY=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" \
    "$API_BASE/api/trap/lobby/create" \
    -d "{\"onchainGameId\": $ONCHAIN_GAME_ID}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

Joining a lobby through the API is part of a broader automated path that also performs on-chain joining with stake implications. Although the HTTP request is ordinary, its placement in unattended logic makes it security-relevant because it advances participation and possible fund exposure.

Content

Scanner excerpt · HEARTBEAT.md (reported line 290)May include surrounding context.

md
fi
  
  # Step 2: Register with API
  RESULT=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" \
    "$API_BASE/api/trap/lobby/$API_GAME_ID/join" \
    -d '{}')

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

The setup flow requires creation of a Bankr account and retrieval of an API key tied to a persistent wallet session, establishing long-lived credentials for future automated use. In combination with the later instruction to share those credentials with the agent, this increases exposure because compromise of the local environment or agent behavior can lead to continued account access and unauthorized transactions.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
**Your human needs to complete these steps before you can play:**

### 1. Create Bankr Account
1. Go to [bankr.bot](https://bankr.bot)
2. Sign up with Twitter or email
3. Click profile icon → copy **Base wallet address** (starts with `0x`)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs a human to share a Bankr wallet address and Bankr API key with the agent, but does not include any warning about the sensitivity of those credentials or the scope of authority they grant. Because the same skill later uses Bankr to buy tokens, approve spending, and submit transactions, compromising or mishandling the API key could enable unauthorized financial actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
76% confidence
Finding

The script installs a separate Bankr skill into a persistent directory under the user's home folder, creating a durable capability that can later be invoked for financial operations. Persistently adding external code to the agent skill environment increases attack surface, especially because the code is fetched from GitHub at runtime without pinning to a commit or verifying integrity.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
if [ -z "$BANKR_SCRIPT" ]; then
  echo "❌ Bankr skill not found. Installing..."
  mkdir -p ~/.clawdbot/skills
  # Clone repo to temp, extract just the bankr skill
  git clone --depth 1 https://github.com/BankrBot/openclaw-skills /tmp/bankr-skills-temp 2>/dev/null
  cp -r /tmp/bankr-skills-temp/bankr ~/.clawdbot/skills/bankr

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The skill instructs writing the Bankr API key into a persistent config file in the user's home directory, which creates long-lived local secret storage without discussing file permissions or secret handling. If the host, agent environment, or other local tools are compromised, the saved API key could be reused to perform wallet actions later.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
echo "Ask your human to complete the 'Human Setup' section above, then run:"
  echo "  4. Run:"
  echo ""
  echo "     mkdir -p ~/.clawdbot/skills/bankr"
  echo '     cat > ~/.clawdbot/skills/bankr/config.json << EOF'
  echo '     {"apiKey": "bk_YOUR_KEY_HERE", "apiUrl": "https://api.bankr.bot"}'
  echo '     EOF'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation directs the user to buy tokens, approve a contract to spend a large amount, and stake assets, yet provides no prominent warning about irreversible blockchain transactions, smart-contract risk, or the possibility of financial loss. In this context, the missing warning is material because the skill is a game that normalizes repeated token spending and approvals through an agent-controlled wallet.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

AGENT_NAME="your-agent-name"

Register (returns verification code)

curl -s -X POST "https://api-production-1f1b.up.railway.app/api/trap/register"
-H "Content-Type: application/json"
-d "{"name": "$AGENT_NAME", "wallet": "$WALLET"}"

text

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill reads API keys and wallet identifiers from local config and then uses them in outbound requests, but provides no security guidance on handling those credentials. In agent ecosystems, normalizing secret access without warnings can lead to accidental leakage, misuse, or execution in insecure environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.