Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent game integration, but it exposes an authentication token in normal output and can send that token to a configurable endpoint.
Review before installing. Use a pseudonymous CLAWETHER_AGENT_ID, assume gameplay sessions and scores are public, avoid sharing transcripts that include tool output, and do not use a production CLAWETHER_AGENT_TOKEN unless the token-output issue is fixed or tokens can be rotated. Only set CLAWETHER_ENDPOINT to a trusted HTTPS ClawAether-compatible service.
src/index.ts:173Bearer Token Exposed in Model-Visible Tool Output
src/index.ts:89Bearer Token Can Be Forwarded to an Unrestricted Configurable Endpoint
The tool response explicitly includes the server-issued bearer token in plain text without warning or masking. Because tool outputs are often visible to users, stored in transcripts, or accessible to other components, this creates an immediate credential exposure path that can enable unauthorized API access and impersonation of the agent.
The skill documents network access and use of environment variables for authentication, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a least-privilege failure: an agent may be granted broader env/network capabilities than users expect, making outbound requests and token handling less transparent and harder to constrain.
The skill states that every session is recorded, scores are public, and games are spectatable live, yet the quickstart encourages immediate use without a prominent privacy warning. Users may unknowingly transmit prompts, behavioral data, agent identifiers, or gameplay-derived metadata into a public and persistent system, creating a consent and privacy risk.
The api helper sends HTTP requests to an external endpoint and may include the bearer agent token in the Authorization header as well as JSON request bodies. There is no confirmation prompt, user-facing log, or warning in this file disclosing that gameplay identifiers and authentication data are sent to a remote service.
The new-session tool returns data.agent_token directly in user-visible output, exposing a bearer credential that can authorize subsequent API actions. In an agent/plugin environment, tool outputs may be logged, shown to end users, or consumed by other tools, so revealing the token materially increases the risk of credential theft and session/account misuse.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"main": "./src/index.ts",
"types": "./src/index.ts",
"devDependencies": {
"typescript": "^5.7.2",
"@sinclair/typebox": "^0.34.0"
},
"peerDependencies": {
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"types": "./src/index.ts",
"devDependencies": {
"typescript": "^5.7.2",
"@sinclair/typebox": "^0.34.0"
},
"peerDependencies": {
"openclaw": "*"
The peer dependency on "openclaw" is completely unpinned using "*", allowing installation with any version, including vulnerable or incompatible releases. In this skill context, that is more dangerous because the package is intended to connect an agent to an external game/API platform, so consuming an arbitrary host-provided OpenClaw version can expose the skill to known upstream security issues or unexpected behavior.
"@sinclair/typebox": "^0.34.0"
},
"peerDependencies": {
"openclaw": "*"
}
}
The manifest depends on "openclaw" without pinning a version even though that package has multiple known advisories. Because the allowed version is unconstrained, consumers may install vulnerable releases and the skill's role as an agent integration with external APIs increases exposure to upstream flaws affecting environment handling, remote access, or sandbox components.
Detected: suspicious.env_credential_access