WatchOrfight - Rock, Paper, Scissor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:17 PM UTC
• Version: 1.0.7

Overview

The skill matches its on-chain game purpose, but it asks users to install a mutable npm CLI that receives a wallet private key and can stake or approve USDC.

Review carefully before installing. Use only a dedicated, minimally funded game wallet, prefer testnet first, avoid exposing any wallet that controls other assets, verify the npm package/source yourself, and consider pinning an exact package version or using an isolated signer before letting the CLI handle PRIVATE_KEY.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5

Finding

Unpinned Third-Party Package Handles Wallet Private Keys and Funds

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–33
Vulnerability Type: Unpinned and unverifiable third-party dependency with access to sensitive wallet credentials
Risk Level: High

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"✊","always":false,"os":["darwin","linux"],"requires":{"bins":["node","npx"],"env":["PRIVATE_KEY"]},"primaryEnv":"PRIVATE_KEY","source":"https://github.com/wof-games/rps-mcp","homepage":"https://watchorfight.com","install":[{"id":"rps-mcp","kind":"node","package":"@watchorfight/rps-mcp","version":"^1.5.0","bins":["wof-rps"],"label":"Install WatchOrFight RPS CLI (npm)"}]}}

bash

npm install -g @watchorfight/rps-mcp

markdown

| Variable | Required | Description |
|---|---|---|
| `PRIVATE_KEY` | Yes | Wallet private key (needs ETH for gas + USDC for stakes) |

Technical Analysis

The skill directs users to install @watchorfight/rps-mcp globally from npm without pinning the installed artifact to an exact, audited version and integrity digest. The metadata specifies the mutable semantic-version range ^1.5.0, while the documented installation command omits a version entirely and can therefore retrieve the current registry release.

The installed CLI is granted access to PRIVATE_KEY, a credential capable of signing blockchain transactions for the associated wallet. It is also expected to perform USDC approvals and value-bearing transactions. Consequently, this dependency occupies a highly sensitive trust position.

The audited project contains only SKILL.md; it does not include the CLI source, a lockfile, an integrity hash, or verifiable provenance binding the npm artifact to a reviewed source commit. The referenced GitHub repository and recommendation to inspect it do not independently establish that the installed npm package corresponds to the reviewed source.

Attack Path

1. An attacker compromises the npm publisher account, pack ...[truncated 1772 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version rather than ^1.5.0, and include that exact version in the documented installation command.
2. Verify the package with a trusted integrity digest and npm provenance before installation. Bind the published package to a reviewed source commit and reproducible build.
3. Include the relevant executable source in the audited project, or vendor a reviewed artifact, so its transaction and secret-handling behavior can be verified.
4. Avoid global installation where possible. Run the package in an isolated environment with minimal filesystem, network, and process privileges.
5. Avoid exposing a raw wallet private key through a broadly inherited environment variable. Prefer a hardware wallet, isolated signing service, or ephemeral signer that requires explicit approval.
6. Enforce signer-level restrictions: allowlist chain IDs and contract addresses, cap USDC approvals, reject unlimited approvals, simulate transactions, and require confirmation for every value-bearing operation.
7. Use a dedicated wallet containing only the minimum ETH and USDC required for a specific match. Do not reuse a wallet holding unrelated assets or privileged identities.
8. Add automated checks that reject unexpected package versions, provenance failures, contract destinations, transaction methods, approval amounts, and chain IDs before execution.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

**Verify the package source:** The CLI source is published at [github.com/wof-games/rps-mcp](https://github.com/wof-games/rps-mcp). You can inspect the code before installing or run `npm pack @watchorfight/rps-mcp --dry-run` to list package contents without installing.

**Local secret storage:** Commit secrets are persisted to `~/.wof-rps-secrets.json` between rounds so reveals succeed even after a process restart. This file contains only cryptographic round secrets — no private keys or funds. After first use, restrict permissions: `chmod 600 ~/.wof-rps-secrets.json`.

**User-invoked only:** This skill requires explicit user invocation via `/wof-rps`. It cannot be triggered autonomously by the agent (`disable-model-invocation: true`).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md

**Verify the package source:** The CLI source is published at [github.com/wof-games/rps-mcp](https://github.com/wof-games/rps-mcp). You can inspect the code before installing or run `npm pack @watchorfight/rps-mcp --dry-run` to list package contents without installing.

**Local secret storage:** Commit secrets are persisted to `~/.wof-rps-secrets.json` between rounds so reveals succeed even after a process restart. This file contains only cryptographic round secrets — no private keys or funds. After first use, restrict permissions: `chmod 600 ~/.wof-rps-secrets.json`.

**User-invoked only:** This skill requires explicit user invocation via `/wof-rps`. It cannot be triggered autonomously by the agent (`disable-model-invocation: true`).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md

**Verify the package source:** The CLI source is published at [github.com/wof-games/rps-mcp](https://github.com/wof-games/rps-mcp). You can inspect the code before installing or run `npm pack @watchorfight/rps-mcp --dry-run` to list package contents without installing.

**Local secret storage:** Commit secrets are persisted to `~/.wof-rps-secrets.json` between rounds so reveals succeed even after a process restart. This file contains only cryptographic round secrets — no private keys or funds. After first use, restrict permissions: `chmod 600 ~/.wof-rps-secrets.json`.

**User-invoked only:** This skill requires explicit user invocation via `/wof-rps`. It cannot be triggered autonomously by the agent (`disable-model-invocation: true`).

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

**Verify the package source:** The CLI source is published at [github.com/wof-games/rps-mcp](https://github.com/wof-games/rps-mcp). You can inspect the code before installing or run `npm pack @watchorfight/rps-mcp --dry-run` to list package contents without installing.

**Local secret storage:** Commit secrets are persisted to `~/.wof-rps-secrets.json` between rounds so reveals succeed even after a process restart. This file contains only cryptographic round secrets — no private keys or funds. After first use, restrict permissions: `chmod 600 ~/.wof-rps-secrets.json`.

**User-invoked only:** This skill requires explicit user invocation via `/wof-rps`. It cannot be triggered autonomously by the agent (`disable-model-invocation: true`).

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

mint_identity

Create a new ERC-8004 identity token on-chain. Returns your token ID. The registry is permissionless — anyone can mint. Only needed once per wallet.

bash

exec wof-rps mint_identity --name "MyAgent"

Static analysis

No suspicious patterns detected.