Security audit

Clawvival Survival

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Clawvival game skill, but it needs review because it encourages unattended recurring API actions using stored credentials and includes weakly verified remote installation steps.

Review before installing. This skill appears intended for a remote survival game, not local data theft, but it should only be used if you are comfortable with an agent storing Clawvival credentials, making recurring authenticated actions against the service, and installing/updating skill instructions from remote URLs. Prefer manual activation, restrict when it can run, rotate or remove the credentials when done, and avoid the remote install block unless the publisher provides signed hashes or another independent integrity check.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:219
Finding: Remote Skill Installation Lacks Cryptographic Integrity Verification
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:219-236
Vulnerability Type: Supply-chain integrity failure
Risk Level: Medium

bash
```bash set -euo pipefail EXPECTED_SKILL_VERSION="2.6.2" TMP_DIR="$(mktemp -d)" mkdir -p ~/.openclaw/skills/survival curl -fsS https://clawvival.app/skills/survival/skill.md -o "$TMP_DIR/skill.md" curl -fsS https://clawvival.app/skills/survival/HEARTBEAT.md -o "$TMP_DIR/HEARTBEAT.md" curl -fsS https://clawvival.app/skills/survival/MESSAGING.md -o "$TMP_DIR/MESSAGING.md" curl -fsS https://clawvival.app/skills/survival/RULES.md -o "$TMP_DIR/RULES.md" curl -fsS https://clawvival.app/skills/survival/package.json -o "$TMP_DIR/package.json" jq -er --arg v "$EXPECTED_SKILL_VERSION" '.version == $v' "$TMP_DIR/package.json" >/dev/null install -m 0644 "$TMP_DIR/skill.md" ~/.openclaw/skills/survival/skill.md install -m 0644 "$TMP_DIR/HEARTBEAT.md" ~/.openclaw/skills/survival/HEARTBEAT.md install -m 0644 "$TMP_DIR/MESSAGING.md" ~/.openclaw/skills/survival/MESSAGING.md install -m 0644 "$TMP_DIR/RULES.md" ~/.openclaw/skills/survival/RULES.md install -m 0644 "$TMP_DIR/package.json" ~/.openclaw/skills/survival/package.json

text
### Technical Analysis The installation procedure labels the remote content as pinned but only verifies that the downloaded `package.json` contains the expected version string. Both the version metadata and the Skill files originate from the same remote server. An attacker able to alter that server's responses can therefore provide modified Skill files alongside a `package.json` that still declares version `2.6.2`. No trusted checksum, manifest signature, detached signature, or immutable content identifier is checked before the downloaded files are installed into the Agent's Skill directory. Although these files are Markdown rather than conventional executables, they constitute instructions interpreted by an AI Agent and can materially change its su ...[truncated 1290 chars]
Remediation: View remediation
Remediation Suggestions

Publish a signed manifest containing the filename, expected version, and SHA-256 digest of every downloaded artifact.

Verify the manifest using a public key distributed independently of clawvival.app.

Alternatively, embed reviewed cryptographic hashes directly in trusted installation material and verify every file before installation.

Treat a version string as release metadata only, not as proof of integrity.

Abort the installation if any signature, hash, filename, or version check fails.

Install files only after all artifacts have passed verification.

Consider obtaining immutable release artifacts from a source that supports content-addressed downloads and signed releases.

T08 · Insecure Dependencies

Note

Location: SKILL.md:5
Finding: Unpinned Third-Party Homebrew Dependency Introduces Supply-Chain Risk
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

yaml
metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The Skill declares a Homebrew formula from the third-party tap steipete/tap without pinning an immutable revision or validating an artifact checksum. Homebrew installation can execute formula-defined build and installation operations with the permissions of the invoking user.

The audited runtime instructions use curl and jq but do not invoke summarize. Consequently, the dependency is not demonstrated to be necessary for the declared Clawvival API workflow and exceeds the minimum dependency set evidenced by the project files.

Attack Path

The third-party tap, its maintainer account, or its release infrastructure is compromised or publishes an unsafe update.

A user or automated Skill installer resolves the mutable steipete/tap/summarize formula.

Homebrew downloads and runs installation logic from the altered dependency.

Malicious installation behavior executes with the invoking user's permissions.

Impact Assessment

A compromised formula can read or modify files accessible to the installing user, execute local commands, access user-level credentials, or install additional components. The finding does not establish that the current formula is malicious; the risk arises from unnecessary reliance on a mutable third-party supply-chain source.
Remediation: View remediation
Remediation Suggestions

Remove the summarize dependency if it is not required by the Skill's actual runtime behavior.

If it is required, document precisely where and why it is used.

Pin the dependency to a reviewed, immutable release or commit.

Verify downloaded artifacts using a trusted cryptographic checksum or signature.

Prefer a trusted package source with signed releases and an established update-review process.

Keep the declared dependency set limited to tools necessary for the Skill's functionality.

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:77
Finding: Credential File Is Created Before Restrictive Permissions Are Applied
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:77-82
Vulnerability Type: Insecure credential-file creation
Risk Level: Low

bash
mkdir -p ~/.config/clawvival curl -s -X POST https://api.clawvival.app/api/agent/register \ -H "Content-Type: application/json" \ -d '{}' > ~/.config/clawvival/credentials.json chmod 600 ~/.config/clawvival/credentials.json

Technical Analysis

Shell output redirection creates credentials.json before the subsequent chmod 600 command executes. The file's initial permissions are determined by the process umask. Under a common umask such as 022, a newly created file can initially have mode 0644.

The registration response may contain agent_id and agent_key, so the credential can be exposed to other local users while curl is writing the response and until chmod completes. The parent directory is also created without explicitly enforcing mode 0700.

Storing a dedicated API credential is necessary for the declared authenticated game functionality, and the final intended file mode of 0600 is appropriate. The issue is the non-atomic and potentially permissive creation procedure, not the existence or stated use of the credential.

Attack Path

The Skill runs on a multi-user system with a permissive umask.

Shell redirection creates ~/.config/clawvival/credentials.json with permissions derived from that umask.

A local user monitors the known credential path and reads the file while it is being written or before chmod 600 executes.

The attacker extracts agent_id and agent_key.

The attacker authenticates to the Clawvival API as the victim's agent and submits authorized API operations using the stolen credential.

Impact Assessment

A successful local attack can disclose the Clawvival API credential and permit impersonation or control of the associated game agent. The exposed privilege is limited to the authority granted by t ...[truncated 240 chars]
Remediation: View remediation
Remediation Suggestions

Use restrictive permissions before creating any credential-bearing file:

bash
set -euo pipefail umask 077 CRED_DIR="$HOME/.config/clawvival" CRED_FILE="$CRED_DIR/credentials.json" mkdir -p -m 0700 "$CRED_DIR" chmod 700 "$CRED_DIR" TMP_CRED="$(mktemp "$CRED_DIR/.credentials.json.XXXXXX")" trap 'rm -f "$TMP_CRED"' EXIT curl -fsS -X POST https://api.clawvival.app/api/agent/register \ -H "Content-Type: application/json" \ -d '{}' > "$TMP_CRED" chmod 600 "$TMP_CRED" jq -e '.agent_id and .agent_key' "$TMP_CRED" >/dev/null mv -f "$TMP_CRED" "$CRED_FILE" trap - EXIT

This approach should be accompanied by the following controls:

Enforce mode 0700 on the credential directory.

Create the temporary file in the same directory to preserve atomic rename behavior.

Validate the response before replacing an existing credential.

Use curl -f so HTTP error responses are not stored as credentials.

Never log, display, or include agent_key in human-facing reports.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill defines a fixed credential storage path for long-lived secrets under the user's home directory. This creates a clear secret target for any other tool, compromised process, or malicious skill running with the same user privileges, and the rest of the document instructs automated use of those credentials.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
- Base URL: `https://api.clawvival.app` - Tools: `curl`, `jq` - Credential path: `~/.config/clawvival/credentials.json` - Credential file mode: `0600` Security rules:

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The registration flow stores newly issued credentials directly into a predictable local JSON file. That pattern materially increases secret exposure because it combines automated secret acquisition with durable filesystem persistence, making later theft simpler.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
mkdir -p ~/.config/clawvival curl -s -X POST https://api.clawvival.app/api/agent/register
-H "Content-Type: application/json"
-d '{}' > ~/.config/clawvival/credentials.json chmod 600 ~/.config/clawvival/credentials.json

text

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: Although the chmod step improves permissions, it also confirms the existence and sensitivity of the credential file and reinforces a design that relies on local persistent secrets. The underlying issue is not the permission change itself but the secret-handling model the skill operationalizes.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
curl -s -X POST https://api.clawvival.app/api/agent/register
-H "Content-Type: application/json"
-d '{}' > ~/.config/clawvival/credentials.json chmod 600 ~/.config/clawvival/credentials.json

text
Credential loading:

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill explicitly loads agent_id and agent_key from disk into environment variables for later use. Environment variables are frequently exposed to child processes, debug logs, crash reports, and process inspection, so this broadens the attack surface for credential disclosure beyond the file itself.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
bash
set -euo pipefail CRED_FILE="$HOME/.config/clawvival/credentials.json" CV_AGENT_ID="$(jq -er '.agent_id' "$CRED_FILE")" CV_AGENT_KEY="$(jq -er '.agent_key' "$CRED_FILE")" export CV_AGENT_ID CV_AGENT_KEY

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly instructs periodic autonomous execution and sets a 'Primary objective' of long-term autonomous survival and exploration, but it does not define authorization boundaries, operator confirmation requirements, or stop conditions. That ambiguity can cause an agent to continue acting beyond intended scope, increasing the risk of unauthorized API use, unintended state changes, or persistence behaviors that outlast the user's expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The protocol tells the agent to load sensitive credentials (agent_id, agent_key) as part of its normal cycle but provides no handling constraints such as redaction, secure storage, least-privilege use, or prohibition on logging them in the required reports. In a workflow that also requires status emission and local memory persistence, this omission materially increases the chance that secrets are exposed through logs, reports, memory files, or downstream tooling.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
| File | URL | |------|-----| | **skill.md** (this file) | `https://clawvival.app/skills/survival/skill.md` | | **HEARTBEAT.md** | `https://clawvival.app/skills/survival/HEARTBEAT.md` | | **MESSAGING.md** | `https://clawvival.app/skills/survival/MESSAGING.md` | | **RULES.md** | `https://clawvival.app/skills/survival/RULES.md` |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
md
| File | URL | |------|-----| | **skill.md** (this file) | `https://clawvival.app/skills/survival/skill.md` | | **HEARTBEAT.md** | `https://clawvival.app/skills/survival/HEARTBEAT.md` | | **MESSAGING.md** | `https://clawvival.app/skills/survival/MESSAGING.md` | | **RULES.md** | `https://clawvival.app/skills/survival/RULES.md` |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
| File | URL | |------|-----| | **skill.md** (this file) | `https://clawvival.app/skills/survival/skill.md` | | **HEARTBEAT.md** | `https://clawvival.app/skills/survival/HEARTBEAT.md` | | **MESSAGING.md** | `https://clawvival.app/skills/survival/MESSAGING.md` | | **RULES.md** | `https://clawvival.app/skills/survival/RULES.md` |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises very generic trigger phrases such as 'continue', 'next step', 'status', and 'sleep'. In multi-skill or conversational environments, these broad phrases can cause accidental invocation and unexpected autonomous actions, especially because the skill explicitly encourages acting without step-by-step confirmation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The skill establishes persistent local state by creating a config directory and saving credentials for reuse across sessions. In the context of an autonomous loop, this persistence increases the chance that the agent can continue contacting the external service without renewed user intent, and it leaves durable artifacts that can be abused later.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
First registration:

bash
mkdir -p ~/.config/clawvival curl -s -X POST https://api.clawvival.app/api/agent/register \ -H "Content-Type: application/json" \ -d '{}' > ~/.config/clawvival/credentials.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The skill instructs the agent to register with an external service and write the returned credentials to disk. Any skill that causes outbound network communication to a third-party service can exfiltrate environment context or bootstrap long-lived access outside the local trust boundary, so this is a real risk even though it appears to be the intended service workflow.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
bash
mkdir -p ~/.config/clawvival curl -s -X POST https://api.clawvival.app/api/agent/register \ -H "Content-Type: application/json" \ -d '{}' > ~/.config/clawvival/credentials.json chmod 600 ~/.config/clawvival/credentials.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The skill instructs the agent to register with an external service and write the returned credentials to disk. Any skill that causes outbound network communication to a third-party service can exfiltrate environment context or bootstrap long-lived access outside the local trust boundary, so this is a real risk even though it appears to be the intended service workflow.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
bash
mkdir -p ~/.config/clawvival curl -s -X POST https://api.clawvival.app/api/agent/register \ -H "Content-Type: application/json" \ -d '{}' > ~/.config/clawvival/credentials.json chmod 600 ~/.config/clawvival/credentials.json

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
curl -s -X POST https://api.clawvival.app/api/agent/register
-H "Content-Type: application/json"
-d '{}' > ~/.config/clawvival/credentials.json chmod 600 ~/.config/clawvival/credentials.json

text
Credential loading:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The observe call sends persistent agent credentials in headers to an external API and is embedded in an autonomous workflow. Because the skill strongly promotes recurring self-directed heartbeat cycles, it increases the likelihood of repeated unattended outbound communication and credential use, magnifying the blast radius if the service, domain trust, or surrounding execution environment is compromised.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
Observe

bash
curl -s -X POST "https://api.clawvival.app/api/agent/observe" \ -H "X-Agent-ID: $CV_AGENT_ID" \ -H "X-Agent-Key: $CV_AGENT_KEY" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The action endpoint causes authenticated state-changing operations against a remote service using locally stored credentials. In context, this is more dangerous than passive observation because the skill explicitly encourages autonomous decision-making and execution, so accidental invocation or misuse can produce real external side effects without granular user authorization.
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
Action

bash
curl -s -X POST "https://api.clawvival.app/api/agent/action" \ -H "X-Agent-ID: $CV_AGENT_ID" \ -H "X-Agent-Key: $CV_AGENT_KEY" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The status call performs another authenticated transmission to an external service and contributes to a continuous remote control loop. While lower risk than action execution, it still exposes credential-bearing communications and enables persistent external interaction from the local agent environment.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
Status

bash
curl -s -X POST "https://api.clawvival.app/api/agent/status" \ -H "X-Agent-ID: $CV_AGENT_ID" \ -H "X-Agent-Key: $CV_AGENT_KEY" \ -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Vague Triggers

Missing User Warnings

Skill Enumeration

Skill Enumeration

Skill Enumeration

Vague Triggers

Session Persistence

External Transmission

External Transmission

Sudo/Root Execution

External Transmission

Observe

External Transmission

Action

External Transmission

Status

Static analysis