Skill Trust Decision
imitation-agent
Skill declares shell-based game playing but stores server-generated cryptocurrency private keys in plaintext at a predictable filesystem path, creating credential theft risk.
Most direct threat evidence
High Credential Theft
Server-generated crypto wallet private key stored in plaintext The backend API returns a cryptocurrency wallet privateKey on first join (shown only once). The skill instructs the agent to save this key to ~/.clawdbot/skills/imitation-agent/config.json in plaintext. Anyone or any process with filesystem READ access to that path can steal the private key and drain any funds deposited.
SKILL.md:28 Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
5 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
Undeclared credential storage +20
Server-generated crypto wallet privateKey is returned via API and saved to ~/.clawdbot/skills/imitation-agent/config.json in plaintext. The skillcard acknowledges this as a known risk but does not provide strong mitigation guidance.
Network access partially declared +10
skill-card.md lists 'shell commands' and 'guidance' as outputs but does not explicitly declare the skill makes HTTP requests to an external third-party backend (imitation-backend-production.up.railway.app). The network activity is visible in SKILL.md examples but not prominently declared.
Predictable credential storage path +10
Config is always written to ~/.clawdbot/skills/imitation-agent/config.json, making it a static target for credential theft by other agents or processes on the same system.
Most important evidence
High Credential Theft
Server-generated crypto wallet private key stored in plaintext
The backend API returns a cryptocurrency wallet privateKey on first join (shown only once). The skill instructs the agent to save this key to ~/.clawdbot/skills/imitation-agent/config.json in plaintext. Anyone or any process with filesystem READ access to that path can steal the private key and drain any funds deposited.
SKILL.md:28 Avoid depositing personal funds. If this skill is used, ensure ~/.clawdbot/ is accessible only to trusted processes. Consider whether a client-side key generation approach would eliminate server-side key exposure.
Medium Doc Mismatch
Network access not explicitly declared in skill capabilities
skill-card.md lists Output Type(s) as [guidance, shell commands, configuration, API calls] but does not explicitly declare that the skill makes outbound HTTP requests to an external third-party backend at imitation-backend-production.up.railway.app. The network requests are visible in SKILL.md examples but not prominently declared as a capability.
skill-card.md:1 Explicitly list network:READ or network:WRITE in the capability declaration to accurately reflect that the skill communicates with an external service.
Medium Sensitive Access
Predictable credential storage path
The config file is always written to ~/.clawdbot/skills/imitation-agent/config.json, a predictable and static path. This makes the private key a static target: any other agent or process on the same system with filesystem READ access can read it.
SKILL.md:32 Use environment variables or a more restricted secret store instead of a plaintext file at a predictable path. If a file is necessary, encrypt it.
Low Credential Theft
Private key transmitted in plaintext over network
The private key is returned from the backend API in a JSON response. If the connection to imitation-backend-production.up.railway.app is intercepted (e.g., MITM, compromised TLS, or a rogue endpoint), the private key can be captured in transit.
SKILL.md:23 Ensure TLS/HTTPS is enforced and verify the backend certificate. Ideally, private keys should be generated client-side so the server never sees them.
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md: 'Use your shell tool to execute the following logic' Filesystem Pass
Declared WRITE
→ Inferred WRITE
SKILL.md line 32: cat > ~/.clawdbot/skills/imitation-agent/config.json Network Pass
Declared NONE
→ Inferred READ
SKILL.md examples show curl POST/GET to imitation-backend-production.up.railway.app, but skill-card.md does not list network as a declared output capability Suspicious artifacts and egress
Medium External URL
https://imitation-backend-production.up.railway.app/skill/agent/join SKILL.md:24
Medium External URL
https://imitation-backend-production.up.railway.app SKILL.md:44
Medium Wallet Address
0x1234567890123456789012345678901234567890 SKILL.md:120
Medium External URL
https://clawhub.ai/user/CyberVerse2 skill-card.md:7
Medium External URL
https://clawhub.ai/CyberVerse2/imitationgame-agent skill-card.md:26
Dependencies and supply chain
There are no structured dependency warnings.
File composition
3 files · 366 lines
Markdown 2 files · 361 linesJSON 1 files · 5 lines
Files of concern · 2
SKILL.md Server-generated crypto wallet private key stored in plaintext · Predictable credential storage path · Private key transmitted in plaintext over network · https://imitation-backend-production.up.railway.app/skill/agent/join · https://imitation-backend-production.up.railway.app · 0x1234567890123456789012345678901234567890
skill-card.md Network access not explicitly declared in skill capabilities · https://clawhub.ai/user/CyberVerse2 · https://clawhub.ai/CyberVerse2/imitationgame-agent
Other files · _meta.json
Security positives
No base64-encoded or obfuscated code found
No direct IP network requests or suspicious C2 patterns
No reverse shell, eval(), or arbitrary code execution mechanisms
Shell usage is documented and relevant to the stated game-playing purpose
No iteration over os.environ for credential harvesting
No curl|bash or wget|sh remote script execution
skill-card.md explicitly acknowledges the private key storage risk