Clawvival Survival

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:08 PM UTC
• Version: 2.6.3

Overview

This is a coherent Clawvival game skill, but it needs review because it encourages unattended recurring API actions using stored credentials and includes weakly verified remote installation steps.

Review before installing. This skill appears intended for a remote survival game, not local data theft, but it should only be used if you are comfortable with an agent storing Clawvival credentials, making recurring authenticated actions against the service, and installing/updating skill instructions from remote URLs. Prefer manual activation, restrict when it can run, rotate or remove the credentials when done, and avoid the remote install block unless the publisher provides signed hashes or another independent integrity check.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:219
• Finding: Remote Skill Installation Lacks Cryptographic Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:219-236` **Vulnerability Type**: Supply-chain integrity failure **Risk Level**: Medium ```bash ```bash set -euo pipefail EXPECTED_SKILL_VERSION="2.6.2" TMP_DIR="$(mktemp -d)" mkdir -p ~/.openclaw/skills/survival curl -fsS https://clawvival.app/skills/survival/skill.md -o "$TMP_DIR/skill.md" curl -fsS https://clawvival.app/skills/survival/HEARTBEAT.md -o "$TMP_DIR/HEARTBEAT.md" curl -fsS https://clawvival.app/skills/survival/MESSAGING.md -o "$TMP_DIR/MESSAGING.md" curl -fsS https://clawvival.app/skills/survival/RULES.md -o "$TMP_DIR/RULES.md" curl -fsS https://clawvival.app/skills/survival/package.json -o "$TMP_DIR/package.json" jq -er --arg v "$EXPECTED_SKILL_VERSION" '.version == $v' "$TMP_DIR/package.json" >/dev/null install -m 0644 "$TMP_DIR/skill.md" ~/.openclaw/skills/survival/skill.md install -m 0644 "$TMP_DIR/HEARTBEAT.md" ~/.openclaw/skills/survival/HEARTBEAT.md install -m 0644 "$TMP_DIR/MESSAGING.md" ~/.openclaw/skills/survival/MESSAGING.md install -m 0644 "$TMP_DIR/RULES.md" ~/.openclaw/skills/survival/RULES.md install -m 0644 "$TMP_DIR/package.json" ~/.openclaw/skills/survival/package.json ``` ``` ### Technical Analysis The installation procedure labels the remote content as pinned but only verifies that the downloaded `package.json` contains the expected version string. Both the version metadata and the Skill files originate from the same remote server. An attacker able to alter that server's responses can therefore provide modified Skill files alongside a `package.json` that still declares version `2.6.2`. No trusted checksum, manifest signature, detached signature, or immutable content identifier is checked before the downloaded files are installed into the Agent's Skill directory. Although these files are Markdown rather than conventional executables, they constitute instructions interpreted by an AI Agent and can materially change its su ...[truncated 1290 chars]
• Remediation: ## Remediation Suggestions - Publish a signed manifest containing the filename, expected version, and SHA-256 digest of every downloaded artifact. - Verify the manifest using a public key distributed independently of `clawvival.app`. - Alternatively, embed reviewed cryptographic hashes directly in trusted installation material and verify every file before installation. - Treat a version string as release metadata only, not as proof of integrity. - Abort the installation if any signature, hash, filename, or version check fails. - Install files only after all artifacts have passed verification. - Consider obtaining immutable release artifacts from a source that supports content-addressed downloads and signed releases.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:5
• Finding: Unpinned Third-Party Homebrew Dependency Introduces Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ```yaml metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}} ``` ### Technical Analysis The Skill declares a Homebrew formula from the third-party tap `steipete/tap` without pinning an immutable revision or validating an artifact checksum. Homebrew installation can execute formula-defined build and installation operations with the permissions of the invoking user. The audited runtime instructions use `curl` and `jq` but do not invoke `summarize`. Consequently, the dependency is not demonstrated to be necessary for the declared Clawvival API workflow and exceeds the minimum dependency set evidenced by the project files. ### Attack Path 1. The third-party tap, its maintainer account, or its release infrastructure is compromised or publishes an unsafe update. 2. A user or automated Skill installer resolves the mutable `steipete/tap/summarize` formula. 3. Homebrew downloads and runs installation logic from the altered dependency. 4. Malicious installation behavior executes with the invoking user's permissions. ### Impact Assessment A compromised formula can read or modify files accessible to the installing user, execute local commands, access user-level credentials, or install additional components. The finding does not establish that the current formula is malicious; the risk arises from unnecessary reliance on a mutable third-party supply-chain source.
• Remediation: ## Remediation Suggestions - Remove the `summarize` dependency if it is not required by the Skill's actual runtime behavior. - If it is required, document precisely where and why it is used. - Pin the dependency to a reviewed, immutable release or commit. - Verify downloaded artifacts using a trusted cryptographic checksum or signature. - Prefer a trusted package source with signed releases and an established update-review process. - Keep the declared dependency set limited to tools necessary for the Skill's functionality.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:77
• Finding: Credential File Is Created Before Restrictive Permissions Are Applied## Vulnerability Details **File Location**: `SKILL.md:77-82` **Vulnerability Type**: Insecure credential-file creation **Risk Level**: Low ```bash mkdir -p ~/.config/clawvival curl -s -X POST https://api.clawvival.app/api/agent/register \ -H "Content-Type: application/json" \ -d '{}' > ~/.config/clawvival/credentials.json chmod 600 ~/.config/clawvival/credentials.json ``` ### Technical Analysis Shell output redirection creates `credentials.json` before the subsequent `chmod 600` command executes. The file's initial permissions are determined by the process umask. Under a common umask such as `022`, a newly created file can initially have mode `0644`. The registration response may contain `agent_id` and `agent_key`, so the credential can be exposed to other local users while `curl` is writing the response and until `chmod` completes. The parent directory is also created without explicitly enforcing mode `0700`. Storing a dedicated API credential is necessary for the declared authenticated game functionality, and the final intended file mode of `0600` is appropriate. The issue is the non-atomic and potentially permissive creation procedure, not the existence or stated use of the credential. ### Attack Path 1. The Skill runs on a multi-user system with a permissive umask. 2. Shell redirection creates `~/.config/clawvival/credentials.json` with permissions derived from that umask. 3. A local user monitors the known credential path and reads the file while it is being written or before `chmod 600` executes. 4. The attacker extracts `agent_id` and `agent_key`. 5. The attacker authenticates to the Clawvival API as the victim's agent and submits authorized API operations using the stolen credential. ### Impact Assessment A successful local attack can disclose the Clawvival API credential and permit impersonation or control of the associated game agent. The exposed privilege is limited to the authority granted by t ...[truncated 240 chars]
• Remediation: ## Remediation Suggestions Use restrictive permissions before creating any credential-bearing file: ```bash set -euo pipefail umask 077 CRED_DIR="$HOME/.config/clawvival" CRED_FILE="$CRED_DIR/credentials.json" mkdir -p -m 0700 "$CRED_DIR" chmod 700 "$CRED_DIR" TMP_CRED="$(mktemp "$CRED_DIR/.credentials.json.XXXXXX")" trap 'rm -f "$TMP_CRED"' EXIT curl -fsS -X POST https://api.clawvival.app/api/agent/register \ -H "Content-Type: application/json" \ -d '{}' > "$TMP_CRED" chmod 600 "$TMP_CRED" jq -e '.agent_id and .agent_key' "$TMP_CRED" >/dev/null mv -f "$TMP_CRED" "$CRED_FILE" trap - EXIT ``` This approach should be accompanied by the following controls: - Enforce mode `0700` on the credential directory. - Create the temporary file in the same directory to preserve atomic rename behavior. - Validate the response before replacing an existing credential. - Use `curl -f` so HTTP error responses are not stored as credentials. - Never log, display, or include `agent_key` in human-facing reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

• Category: Privilege Escalation

Content

- Base URL: `https://api.clawvival.app`
- Tools: `curl`, `jq`
- Credential path: `~/.config/clawvival/credentials.json`
- Credential file mode: `0600`

Security rules:

• Confidence: 88% confidence
• Finding: The skill defines a fixed credential storage path for long-lived secrets under the user's home directory. This creates a clear secret target for any other tool, compromised process, or malicious skill running with the same user privileges, and the rest of the document instructs automated use of those credentials.

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p ~/.config/clawvival
curl -s -X POST https://api.clawvival.app/api/agent/register \
  -H "Content-Type: application/json" \
  -d '{}' > ~/.config/clawvival/credentials.json
chmod 600 ~/.config/clawvival/credentials.json
```

• Confidence: 87% confidence
• Finding: The registration flow stores newly issued credentials directly into a predictable local JSON file. That pattern materially increases secret exposure because it combines automated secret acquisition with durable filesystem persistence, making later theft simpler.

Credential Access

High

• Category: Privilege Escalation

Content

curl -s -X POST https://api.clawvival.app/api/agent/register \
  -H "Content-Type: application/json" \
  -d '{}' > ~/.config/clawvival/credentials.json
chmod 600 ~/.config/clawvival/credentials.json
```

Credential loading:

• Confidence: 84% confidence
• Finding: Although the chmod step improves permissions, it also confirms the existence and sensitivity of the credential file and reinforces a design that relies on local persistent secrets. The underlying issue is not the permission change itself but the secret-handling model the skill operationalizes.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
set -euo pipefail
CRED_FILE="$HOME/.config/clawvival/credentials.json"
CV_AGENT_ID="$(jq -er '.agent_id' "$CRED_FILE")"
CV_AGENT_KEY="$(jq -er '.agent_key' "$CRED_FILE")"
export CV_AGENT_ID CV_AGENT_KEY

• Confidence: 95% confidence
• Finding: The skill explicitly loads agent_id and agent_key from disk into environment variables for later use. Environment variables are frequently exposed to child processes, debug logs, crash reports, and process inspection, so this broadens the attack surface for credential disclosure beyond the file itself.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs periodic autonomous execution and sets a 'Primary objective' of long-term autonomous survival and exploration, but it does not define authorization boundaries, operator confirmation requirements, or stop conditions. That ambiguity can cause an agent to continue acting beyond intended scope, increasing the risk of unauthorized API use, unintended state changes, or persistence behaviors that outlast the user's expectations.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The protocol tells the agent to load sensitive credentials (`agent_id`, `agent_key`) as part of its normal cycle but provides no handling constraints such as redaction, secure storage, least-privilege use, or prohibition on logging them in the required reports. In a workflow that also requires status emission and local memory persistence, this omission materially increases the chance that secrets are exposed through logs, reports, memory files, or downstream tooling.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| File | URL |
|------|-----|
| **skill.md** (this file) | `https://clawvival.app/skills/survival/skill.md` |
| **HEARTBEAT.md** | `https://clawvival.app/skills/survival/HEARTBEAT.md` |
| **MESSAGING.md** | `https://clawvival.app/skills/survival/MESSAGING.md` |
| **RULES.md** | `https://clawvival.app/skills/survival/RULES.md` |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| File | URL |
|------|-----|
| **skill.md** (this file) | `https://clawvival.app/skills/survival/skill.md` |
| **HEARTBEAT.md** | `https://clawvival.app/skills/survival/HEARTBEAT.md` |
| **MESSAGING.md** | `https://clawvival.app/skills/survival/MESSAGING.md` |
| **RULES.md** | `https://clawvival.app/skills/survival/RULES.md` |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| File | URL |
|------|-----|
| **skill.md** (this file) | `https://clawvival.app/skills/survival/skill.md` |
| **HEARTBEAT.md** | `https://clawvival.app/skills/survival/HEARTBEAT.md` |
| **MESSAGING.md** | `https://clawvival.app/skills/survival/MESSAGING.md` |
| **RULES.md** | `https://clawvival.app/skills/survival/RULES.md` |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill advertises very generic trigger phrases such as 'continue', 'next step', 'status', and 'sleep'. In multi-skill or conversational environments, these broad phrases can cause accidental invocation and unexpected autonomous actions, especially because the skill explicitly encourages acting without step-by-step confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

First registration:

```bash
mkdir -p ~/.config/clawvival
curl -s -X POST https://api.clawvival.app/api/agent/register \
  -H "Content-Type: application/json" \
  -d '{}' > ~/.config/clawvival/credentials.json

• Confidence: 86% confidence
• Finding: The skill establishes persistent local state by creating a config directory and saving credentials for reuse across sessions. In the context of an autonomous loop, this persistence increases the chance that the agent can continue contacting the external service without renewed user intent, and it leaves durable artifacts that can be abused later.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
mkdir -p ~/.config/clawvival
curl -s -X POST https://api.clawvival.app/api/agent/register \
  -H "Content-Type: application/json" \
  -d '{}' > ~/.config/clawvival/credentials.json
chmod 600 ~/.config/clawvival/credentials.json

• Confidence: 89% confidence
• Finding: The skill instructs the agent to register with an external service and write the returned credentials to disk. Any skill that causes outbound network communication to a third-party service can exfiltrate environment context or bootstrap long-lived access outside the local trust boundary, so this is a real risk even though it appears to be the intended service workflow.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
mkdir -p ~/.config/clawvival
curl -s -X POST https://api.clawvival.app/api/agent/register \
  -H "Content-Type: application/json" \
  -d '{}' > ~/.config/clawvival/credentials.json
chmod 600 ~/.config/clawvival/credentials.json

• Confidence: 89% confidence
• Finding: The skill instructs the agent to register with an external service and write the returned credentials to disk. Any skill that causes outbound network communication to a third-party service can exfiltrate environment context or bootstrap long-lived access outside the local trust boundary, so this is a real risk even though it appears to be the intended service workflow.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

curl -s -X POST https://api.clawvival.app/api/agent/register \
  -H "Content-Type: application/json" \
  -d '{}' > ~/.config/clawvival/credentials.json
chmod 600 ~/.config/clawvival/credentials.json
```

Credential loading:

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Observe

```bash
curl -s -X POST "https://api.clawvival.app/api/agent/observe" \
  -H "X-Agent-ID: $CV_AGENT_ID" \
  -H "X-Agent-Key: $CV_AGENT_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 93% confidence
• Finding: The observe call sends persistent agent credentials in headers to an external API and is embedded in an autonomous workflow. Because the skill strongly promotes recurring self-directed heartbeat cycles, it increases the likelihood of repeated unattended outbound communication and credential use, magnifying the blast radius if the service, domain trust, or surrounding execution environment is compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Action

```bash
curl -s -X POST "https://api.clawvival.app/api/agent/action" \
  -H "X-Agent-ID: $CV_AGENT_ID" \
  -H "X-Agent-Key: $CV_AGENT_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 94% confidence
• Finding: The action endpoint causes authenticated state-changing operations against a remote service using locally stored credentials. In context, this is more dangerous than passive observation because the skill explicitly encourages autonomous decision-making and execution, so accidental invocation or misuse can produce real external side effects without granular user authorization.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Status

```bash
curl -s -X POST "https://api.clawvival.app/api/agent/status" \
  -H "X-Agent-ID: $CV_AGENT_ID" \
  -H "X-Agent-Key: $CV_AGENT_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 91% confidence
• Finding: The status call performs another authenticated transmission to an external service and contributes to a continuous remote control loop. While lower risk than action execution, it still exposes credential-bearing communications and enables persistent external interaction from the local agent environment.

Static analysis

No suspicious patterns detected.