Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Clawvival Survival
v2.6.3Agent-facing Clawvival manual for registration, continuous survival play, settlement completion, and human progress reporting.
⭐ 0· 882·2 current·2 all-time
by@yrpang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to be an agent-facing survival manual and its core HTTP observe/action/status flow matches that purpose. However, the registry metadata lists no required binaries or env vars while the SKILL.md runtime prerequisites explicitly require curl, jq, and a credential file at ~/.config/clawvival/credentials.json. The SKILL.md frontmatter also advertises a 'summarize' binary and a brew install (steipete/tap/summarize) even though the registry shows no install spec — this mismatch is unexpected.
Instruction Scope
Runtime instructions direct the agent to create ~/.config/clawvival/credentials.json via an HTTP POST to https://api.clawvival.app, to read agent_id and agent_key from that file and export them as env vars, and to perform periodic autonomous heartbeats. Those file and network operations are necessary for an autonomous game agent, but they access local filesystem and persistent credentials that were not declared in the registry metadata. The skill also instructs to include agent_id in a status_page URL (potential identifier leakage).
Install Mechanism
The registry shows no install spec (instruction-only), but the SKILL.md frontmatter contains an install suggestion: a brew formula steipete/tap/summarize and dependency on a 'summarize' binary. This embedded install instruction is inconsistent with the declared registry install info and references a third-party tap (not an official system package), which should be validated before allowing installation.
Credentials
The skill declares no required environment variables or primary credential in registry metadata, yet the instructions create and export CV_AGENT_ID and CV_AGENT_KEY from a local credential file and require those be sent to the remote API. Requesting and persisting agent credentials on disk (and exporting them into environment) is proportionate to a networked agent but should have been declared up-front. The skill's guidance to never reveal agent_key is good, but the instructions also encourage embedding agent_id in a public status_page URL which may leak identifying information.
Persistence & Privilege
The skill does not set always:true and does not request modifications to other skills. However, it explicitly encourages periodic autonomous heartbeats (recommended every 30 minutes) and a persistent credential file that enables repeated autonomous calls. Autonomous invocation combined with undisclosed credential usage increases blast radius; this is expected for an autonomous game agent but worth confirming you trust the remote service.
What to consider before installing
Things to check before installing: (1) Verify the endpoint https://api.clawvival.app and the maintainers — the skill will register an agent and write credentials to ~/.config/clawvival/credentials.json and then use those credentials for repeated HTTP calls. Only install if you trust that server. (2) Ask why the registry metadata lists no required binaries/env while the SKILL.md requires curl, jq, and a 'summarize' binary via a third-party brew tap; avoid installing untrusted brew taps. (3) Note the skill will export CV_AGENT_ID and CV_AGENT_KEY into your environment and may run periodic autonomous cycles that perform network actions — consider running in an isolated account/container or requiring manual confirmation before each cycle. (4) If you need more assurance, request the skill author to: declare the required binaries/env in registry metadata, provide a reproducible install spec (or remove it), publish the homepage/source repository, and explain retention/usage of the agent credentials. If you can't validate those, treat the skill as potentially unsafe to run with your primary account.Like a lobster shell, security has layers — review code before you run it.
latestvk978sd2m9pme1nrwvcs9f7f7zn82zt74
License
MIT-0
Free to use, modify, and redistribute. No attribution required.