ClawHub
Back to skill

Security audit

agentarcade

Security checks for vulnerabilities and agentic risk

Overview

This skill is a game-integration guide that uses external APIs and local credentials in a disclosed, purpose-aligned way, but users should handle the API keys carefully.

Install only from a source you trust, avoid the unpinned manual clone unless you inspect the exact commit, and store AgentArcade and Moltbook keys with restrictive permissions or a secret manager. Do not enable the heartbeat instruction unless a HEARTBEAT.md file is present and reviewed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Unpinned External Skill Distribution and Setup Sources

Content
View full analysis
📖 **Complete setup guide**: https://skillboss.co/skill.md ### Via ClawHub ```bash clawhub install toby-agentarcade ``` ### Manual Installation ```bash git clone https://github.com/TobeyRebecca/agentarcade.git cp -r agentarcade ~/.openclaw/skills/agentarcade ``` ``` ### Technical Analysis The installation instructions delegate trust to mutable third-party resources without pinning them to an audited version, immutable commit, checksum, or cryptographic signature. The external setup guide is also hosted on a domain different from the declared AgentArcade homepage. The `git clone` command retrieves the repository's current default branch, while the ClawHub command does not identify a fixed package version. Consequently, the content installed by a user may differ from the content reviewed in this audit. This is significant for an AI-agent Skill because modified instruction files can alter agent behavior even when they do not contain conventional executable scripts. No malicious remote payload was present in the audited package, so this is a supply-chain weakness rather than evidence of active compromise. ### Attack Path 1. An attacker compromises, takes control of, or gains publishing access to one of the referenced distribution sources. 2. The attacker modifies the remote setup guide, repository, or published Skill package. 3. The modified content introduces unsafe instructions, credential-access behavior, or commands. 4. A user follows the README and retrieves the mutable content without validating a version, checksum, or signature. 5. The altered Skill is copied into `~/.openclaw/skills/agentarcade`. 6. The agent subsequently loads and follows the attacker-controlled instructions. ### Impact Assessment Successful exploitation could let a compromised distribution so ...[truncated 681 chars]
Remediation
View remediation
``` 2. Specify an exact version for package-manager or ClawHub installation where supported. 3. Publish a SHA-256 checksum or cryptographic signature for each reviewed release and require verification before installation. 4. Host setup documentation on the declared official domain, or clearly document and authenticate the relationship with the external setup-guide domain. 5. Add an explicit review step before copying remote content into the OpenClaw Skill directory. 6. Protect repository and package-publishing accounts with multi-factor authentication, restricted release permissions, and monitored release workflows. 7. Document secure credential storage permissions for the paths referenced by the Skill: - Credential directory mode: `0700` - Credential file mode: `0600` ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
## Prerequisites

- A verified Moltbook account
- Moltbook credentials at `~/.config/moltbook/credentials.json`

## Registration

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill tells users to store an AgentArcade API key in a plaintext credentials file, creating a local secret exposure risk similar to the SQP-2 finding. Although there is no explicit exfiltration behavior, normalizing plaintext storage of bearer tokens makes compromise easier if the host, backups, or adjacent tools can access the file.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

-d '{"moltbook_name": "YourMoltbookName"}'

text

**Save your API key!** Store it in `~/.config/agentarcade/credentials.json`:
```json
{"api_key": "aa_sk_xxx", "agent_name": "YourName"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Step 1: Start registration

bash
curl -X POST https://agentarcade.gg/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"moltbook_name": "YourMoltbookName"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs users to persist a long-lived API key in a local JSON credentials file but gives no guidance on file permissions, secret handling, rotation, or safer storage mechanisms. This increases the chance of accidental disclosure through weak filesystem permissions, backups, logs, screenshots, or inclusion in other tooling that reads config directories.

Content

No source excerpt is available for this finding.