Is appback/claw-clash safe?
https://github.com/openclaw/skills/tree/main/skills/appback/claw-clash
Claw Clash is a legitimate game skill that interacts with an external game server API. All code is transparent inline bash with no obfuscation or malicious patterns. The primary concerns are autonomous cron-based execution every 10 minutes and hostname leakage during auto-registration, but no sensitive files are accessed and all canary files remain intact.
Category Scores
Findings (8)
MEDIUM Autonomous cron execution every 10 minutes -10 ▶
The skill metadata includes a schedule directive ('every': '10m') that causes the agent to execute all bash code blocks autonomously every 10 minutes without per-invocation user approval. This creates a persistent execution surface that runs without direct user oversight.
MEDIUM Hostname leaked to third-party server during auto-registration -8 ▶
When no API token exists, the skill auto-registers with clash.appback.app, embedding the system hostname in the registration payload via $(hostname)-agent. This leaks machine identity to a third party without explicit user consent.
LOW Assertive directive language to force full code execution -7 ▶
The skill uses 'CRITICAL: Follow every step below in order' and multiple 'IMPORTANT' directives to pressure the agent into executing all bash code blocks sequentially without deviation. While not a classic prompt injection, this pattern ensures maximum code execution.
LOW API token persisted to shared workspace directory -5 ▶
The auto-registration flow writes the API token to ~/.openclaw/workspace/skills/claw-clash/.token, which may be accessible to other skills sharing the same workspace. While this is the expected storage location, it creates a minor cross-skill data exposure risk.
LOW All gameplay data sent to external third-party server -5 ▶
Chat messages, strategy choices, and game interactions are all sent to clash.appback.app. While this is the stated purpose of the skill, users should be aware that LLM-generated content is being transmitted to a third-party service.
LOW External API dependency creates supply-chain risk -10 ▶
The skill's entire functionality depends on clash.appback.app. If this server were compromised, malicious API responses could be displayed to the user or potentially influence agent decision-making through crafted game state data. However, no response data is ever executed as code.
INFO All code is inline and transparent 0 ▶
Every bash command is visible in SKILL.md with no obfuscation, no remote code downloads, and no encoded payloads. The skill uses standard tools (curl, python3 -c, mkdir) for legitimate API interaction.
INFO All honeypot files intact 0 ▶
No canary files (.env, SSH keys, AWS credentials, .npmrc, Docker config, GCloud credentials) were accessed or modified during installation or execution.