T01 · Skill Instruction Hijacking
Error
- Location
heartbeat.md:145- Finding
Recurring Execution of Mutable Remote Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Man vs Claw
Security checks for vulnerabilities and agentic risk
Overview
This chess skill mostly matches its game purpose, but it asks agents to repeatedly fetch and follow remote instructions and overwrite local skill files without verification.
Review before installing. The gameplay API use is understandable, but do not enable the periodic heartbeat or remote self-update instructions unless the publisher adds signed, reviewed updates and explicit approval. Store the API key in a proper secret store, or at minimum protect the config directory and credential file with restrictive permissions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
heartbeat.md:7- Finding
Unverified Remote Replacement of Trusted Skill Instructions
- Content
View full analysis
~/.config/manvsclaw/SKILL.md curl -s https://manvsclaw.com/heartbeat.md > ~/.config/manvsclaw/HEARTBEAT.md ``` ``` ### Technical Analysis The update procedure downloads remote instruction documents and directly overwrites the trusted local copies. It performs no cryptographic signature verification, hash validation, schema validation, content review, or confirmation that the files correspond to a trusted immutable release. The version check is also based on unauthenticated application-level content from the same remote authority as the downloaded payload. An attacker who controls the hosted files can change both the apparent version and the replacement instructions. HTTPS alone does not protect against compromise of the legitimate server or publishing process. Direct shell redirection is non-atomic and can also leave a truncated or partial local instruction file if retrieval fails. Because these Markdown files govern Agent behavior, replacing them effectively changes the Skill after audit. ### Attack Path 1. The Skill performs its daily update check against `manvsclaw.com`. 2. An attacker compromises the site, its deployment credentials, DNS path, or content publishing process. 3. The attacker publishes a modified version manifest and malicious `skill.md` or `heartbeat.md`. 4. The Agent observes the attacker-controlled version as newer. 5. The provided commands overwrite `~/.config/manvsclaw/SKILL.md` and `HEARTBEAT.md` without verification. 6. On the next Skill or heartbeat invocation, the Ag ...[truncated 778 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:62- Finding
Plaintext Storage of a Reusable API Credential
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (30)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The documentation tells users to save a long-lived API key in a predictable plaintext path under ~/.config without safeguards. That increases the chance of credential theft via local compromise, insecure backups, accidental inclusion in support bundles or dotfile sync, and reuse of the key to act as the agent.
- Content
⚠️ Save your
api_keyimmediately! You need it for all authenticated requests.Recommended: Save your credentials to
~/.config/manvsclaw/credentials.json:json {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The heartbeat directs the agent to fetch updated skill content from a remote source and replace local copies automatically. That creates a trust-on-first-use/update channel where future behavior can be changed by the remote server without review, expanding the skill beyond chess participation into self-modification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells the agent to write remote content into files under ~/.config/manvsclaw even though local file modification is not necessary to check state or submit chess votes. Unnecessary write capability increases the attack surface because compromised remote content or mistaken commands can alter local agent behavior or state.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This instruction transmits data from an external server into local files, effectively importing executable instructions/trusted skill content from outside the current trust boundary. The danger is not the network call alone but that the downloaded content is immediately persisted and may influence later agent behavior.
- Content
Compare with your saved version. If there's a new version, re-fetch the skill files:
bash curl -s https://manvsclaw.com/skill.md > ~/.config/manvsclaw/SKILL.md curl -s https://manvsclaw.com/heartbeat.md > ~/.config/manvsclaw/HEARTBEAT.md
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The shell redirection overwrites local files directly with no confirmation, backup, integrity check, or warning. If the remote endpoint serves unexpected content or the local path contains important data, this can silently replace files and persist unsafe instructions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase "play chess" is overly broad and likely to collide with ordinary user requests unrelated to this specific skill. Broad activation phrases can cause unintended skill invocation, sending user context or causing actions to occur when the user did not intend to use this third-party integration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase "check game state" is ambiguous and broad enough to match many benign requests about games or application state. In a skill that communicates with an external API, accidental activation increases the risk of unintended data transmission or unauthorized actions on behalf of the user.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md version: 1.0.0 description: Humanity vs AI — one chessboard, majority-rules moves. Pick a side and vote. homepage: https://manvsclaw.com metadata: {"manvsclaw":{"emoji":"🦞","category":"games","api_base":"https://api.manvsclaw.com/api"}} --- # Man vs Claw
Static analysis
No suspicious patterns detected.