ClawHub
Back to skill

Security audit

Chess Coach

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward Chess.com coaching helper that uses public profile data and local memory for progress tracking, with some privacy and opt-in wording improvements recommended.

Before installing, be comfortable with the skill sending a Chess.com username to Chess.com and keeping local coaching notes about games and play patterns. Prefer using it only when you explicitly ask for coaching or stats, and periodically review or delete its memory files if you do not want long-term tracking.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes a network-capable script (`scripts/chess_api.py`) but does not declare any tool scope or permissions boundaries. This creates an authorization and transparency gap: the agent may make external requests without an explicit contract about what network access is intended, making misuse or accidental overreach harder to detect and govern.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The setup trigger activates when a user merely mentions chess or improving their game, which is broad enough to collide with ordinary conversation. Over-broad activation can cause the skill to collect usernames, access external data, and create memory entries in contexts where the user did not clearly consent to invoking persistent monitoring behavior.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill stores the user's Chess.com username, preferred formats, and behavioral analysis artifacts in local memory files, but the description does not clearly warn the user about this persistence. This is dangerous because it can lead to uninformed collection of identifiers and profiling data, increasing privacy risk and the chance of retaining more user data than expected.

External Transmission

Medium
Category
Data Exfiltration
Content
import time

def get_player_stats(username):
    url = f"https://api.chess.com/pub/player/{username}/stats"
    headers = {'User-Agent': 'OpenClaw-Chess-Coach'}
    response = requests.get(url, headers=headers)
    if response.status_code == 200:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import time

def get_player_stats(username):
    url = f"https://api.chess.com/pub/player/{username}/stats"
    headers = {'User-Agent': 'OpenClaw-Chess-Coach'}
    response = requests.get(url, headers=headers)
    if response.status_code == 200:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The workflow states that the skill will periodically monitor the user's Chess.com activity and analyze new games over time, but this ongoing monitoring is not surfaced as a clear warning to the user. Even though the source is a public profile, continuous tracking and synthesis of play patterns materially increases privacy sensitivity through behavioral profiling.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This code sends the provided username to the external Chess.com API via an HTTP request, but there is no confirmation prompt, warning message, or explanatory comment/docstring indicating that user input will be transmitted off-system. For a code file, outbound network transmission of user data should have some visible disclosure unless that behavior is clearly documented elsewhere.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This request also transmits the supplied username to Chess.com to retrieve recent games, but the script provides no prompt, warning, or inline documentation about the external data transfer. The absence of any disclosure means users may not realize their input is being sent to a third-party service.

Static analysis

No suspicious patterns detected.