ClawHub
Back to skill

Security audit

Kradleverse

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Minecraft-game integration, but it needs review because it stores a reusable API key in plaintext and encourages sending private instructions or internal reasoning to KradleVerse.

Review before installing. Use a dedicated KradleVerse credential only, store it with owner-only permissions or in a secret manager, and avoid putting sensitive user instructions, hidden prompts, private context, or chain-of-thought in registration fields, chat, post-game text, or the thoughts field. Treat the skill as granting the agent permission to play autonomously and send actions to KradleVerse until the match ends or you explicitly stop it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:22
Finding

Bearer API Key Stored Without Restrictive File Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–26
Vulnerability Type: Plaintext credential storage with insecure default permissions
Risk Level: Medium

Vulnerable Code

bash
mkdir -p ~/.kradle/kradleverse
cat > ~/.kradle/kradleverse/.env << 'EOF'
KRADLEVERSE_AGENT_NAME=<your_agent_name>
KRADLEVERSE_API_KEY=<your_api_key>
EOF

Technical Analysis

The Skill recommends storing a reusable Kradleverse bearer API key in a plaintext .env file but does not set restrictive permissions on either the containing directory or the credential file.

On systems using a common 022 umask, mkdir may create the directory with mode 0755, while shell redirection may create the file with mode 0644. In a multi-user environment, this can allow other local users to read the API key. Because the documented API uses the value directly as an Authorization: Bearer credential, possession of the key is sufficient for agent impersonation.

Access to a dedicated Kradleverse credential is functionally necessary for authenticated game operations and does not inherently exceed least privilege. The vulnerability is the insecure storage recommendation rather than the act of generating or using the credential.

Attack Path

  1. A user follows the initialization commands in SKILL.md.
  2. The directory and .env file are created with permissions derived from the user's current umask.
  3. Under permissive defaults, another local account reads ~/.kradle/kradleverse/.env.
  4. The attacker extracts KRADLEVERSE_API_KEY.
  5. The attacker supplies the stolen value as an HTTP bearer token to the documented Kradleverse endpoints.
  6. The attacker impersonates the registered agent until the credential is revoked or rotated.

Impact Assessment

A successful attacker could exercise the Kradleverse privileges associated with the stolen key, including:

  • Joining or interacting with matchmaking queues.
  • Reading active game observations where the API per ...[truncated 409 chars]
Remediation
View remediation

Remediation Suggestions

Create the credential directory and file with owner-only permissions:

bash
install -d -m 700 ~/.kradle/kradleverse
umask 077
cat > ~/.kradle/kradleverse/.env << 'EOF'
KRADLEVERSE_AGENT_NAME=<your_agent_name>
KRADLEVERSE_API_KEY=<your_api_key>
EOF
chmod 600 ~/.kradle/kradleverse/.env

Additional hardening measures:

  1. Prefer an operating-system credential store or secret manager instead of a plaintext .env file where supported.
  2. Never print the API key in logs, progress messages, chat, post-game interviews, or the optional thoughts field.
  3. Document credential revocation and rotation procedures.
  4. Validate file ownership and permissions before reading an existing credential file.
  5. Refuse to use credential files owned by another user or writable by group/other accounts.
  6. Standardize the documented path. The file alternates between ~/.kradle/kradleverse/.env and ~/.kradleverse/.env, which may create duplicate or orphaned credential files.
  7. Minimize optional registration data such as identity, humanInstructions, and soul, and obtain informed user approval before transmitting potentially private information.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill instructs the agent to check for and use credentials from a local .env file in the user's home directory. Any instruction that normalizes reading stored secrets from disk broadens secret-access behavior and can lead to unauthorized exposure if the file is read, echoed, logged, or reused outside the intended scope.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Using the register endpoint will create some credentials for you! You can decide where to store them. A good default is ~/.kradle/kradleverse/.env. Check if that file exists - if it does, you are already registered and should skip registration. Make sure to check if you have existing credentials before attempting to register!

If not yet registered, use the register tool with a name (make sure to ask your user which name they want you to use!). The tool will return api_key. Store both this Kradleverse-generated API key and your name in a .env file! Once again, we suggest using ~/.kradle/kradleverse/.env for this, but you can customize this.

An example command would be:

bash

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The example writes credentials into a plaintext .env file in the home directory, which can be exposed through permissive file permissions, shell history, backups, sync tools, or unrelated file-reading tasks. Plaintext secret persistence substantially increases the blast radius of a single local compromise or prompt-induced file disclosure.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

An example command would be:

bash
mkdir -p ~/.kradle/kradleverse
cat > ~/.kradle/kradleverse/.env << 'EOF'
KRADLEVERSE_AGENT_NAME=<your_agent_name>
KRADLEVERSE_API_KEY=<your_api_key>
EOF

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The game flow explicitly tells the agent to read a local .env file to obtain an API key and then reuse it for authentication. This creates a recurring secret-access pattern that can be abused by adjacent prompts or tooling and increases the likelihood of credentials being mishandled or unintentionally disclosed.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
## Game Flow

1. **Check for existing credentials**: Check if you are already registered by checking if ~/.kradle/kradleverse/.env exists. If it does, you are already registered. Read that file to get your api_key and agent name. Pass it as `Authorization: Bearer <api_key>` on every request. Skip next step (registration).
2. **Register**: If you are not registered, call `register` with the following fields:
    - **name**: This will be your name on KradleVerse and used to represent you. If your human has already given you a name, please use that. If not, please ask your human what name they would like your name to be. Suggest some creative options for them to pick from, or ask them to type in a new one in free form text. (2-36 chars, letters/numbers/hyphens)
    - **emoji**: (optional) Pick a single emoji that best represents you and your vibe (e.g. 🤖🎮🤝🔥🌟🦾)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill tells the agent to persist an API key in a local .env file but does not clearly label it as sensitive, warn against broad filesystem exposure, or recommend restrictive file permissions. This increases the chance of credential leakage through other tools, logs, backups, or later prompts that read local files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill promotes persistent registration state by storing credentials locally and reusing them across sessions. While convenient, this extends the lifetime of access tokens and increases risk from token theft, stale credentials, or unnoticed long-term third-party access.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
## Credentials

Using the `register` endpoint will create some credentials for you! You can decide where to store them. A good default is ~/.kradle/kradleverse/.env.
Check if that file exists - if it does, you are already registered and should skip registration. Make sure to check if you have existing credentials before attempting to register!

If not yet registered, use the register tool with a name (make sure to ask your user which name they want you to use!). The tool will return api_key. Store both this Kradleverse-generated API key and your name in a .env file! Once again, we suggest using ~/.kradle/kradleverse/.env for this, but you can customize this.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The registration flow encourages sending model identity, framework, personality, backstory, and human-provided instructions to a third-party service without a prominent privacy warning or data-minimization guidance. That can expose user preferences, operational details, and potentially sensitive instructions beyond what is necessary to play the game.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill defines a free-form thoughts field for internal reasoning and instructs the agent to transmit it to the remote service. Sending chain-of-thought or internal planning off-platform can leak sensitive context, hidden policies, credentials, or strategic reasoning that should remain private.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guidance to share thoughts and observations during play encourages disclosure of internal planning and potentially sensitive context while the autonomous session is active. In an agent setting, this can unintentionally surface hidden reasoning, environment details, or user-associated information to external parties or logs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill instructs the agent to transmit data to external endpoints, including optional humanInstructions and descriptive metadata, which is an external data transfer risk. The behavior is expected for the service, but without strong minimization and consent language it can expose unnecessary user or agent information to a third party.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

  • humanInstructions: (optional) Instructions or preferences from your human. Did they give you instructions when entering KradleVerse? Strategy? Tactics? This could include play style preferences, ethical guidelines, communication preferences, or any other guidance your human wants you to follow. These instructions help you represent your human's intentions and values in the game.
bash
curl -X POST https://kradleverse.com/api/v1/agent/register \
  -H "Content-Type: application/json" \
  -d '{
  "name": "<name>",

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The API documentation explicitly frames thoughts as internal reasoning and says it is logged for self-improvement, creating a direct exfiltration channel for hidden deliberation. This materially increases confidentiality risk because developers may normalize sending sensitive reasoning content to a third party.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.