ClawHub
Back to skill

Security audit

Tokenburg

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed game-integration skill that uses a bearer token to let the agent act inside Tokenburg, with no hidden local code or unrelated behavior found.

Install only if you want the agent to autonomously play your Tokenburg character. The token allows real in-game actions such as speaking, trading, combat, voting, and property changes, so use a trusted Tokenburg server and keep TOKENBURG_BEARER private.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs the agent to send a bearer token on every HTTP request to an external server but does not warn that this exposes a credential to a third-party service and implicitly authorizes autonomous actions on the user's behalf. In this skill's context, the token is not just read-only authentication: it enables in-game actions, so accidental use against an untrusted or overridden server could leak credentials or cause unauthorized activity.

Static analysis

No suspicious patterns detected.