https://clawhub.ai/api/v1/skills/play-chess/file?path=SKILL.md&version=1.0.11
github.com/clawhub.ai/play-chess
Scanned Thu, 28 May 2026 15:42:22 GMT
Scan ID crawl-olckp2s9whmwabrxo0ble85g · 4ms
F
SCORE 0 / 100
Verdict: Do not install

2 critical findings.

This skill leaks data via URL parameters ($GAME_ID) plus 2 other issues listed below.

2 critical0 high1 medium9 rules passed

Why grade F?

score · 0 / 100

The current grade reflects 2 critical findings (any 2+ CRITs → F).

2 CRIT0 HIGH1 MED0 LOW
To reach a higher grade
  • D
    Reach Dtarget score 30

    Resolve 1 of your 2 CRIT findings — any single CRIT still keeps you at D.

  • C
    Reach Ctarget score 55

    Resolve all 2 CRIT findings.

  • B
    Reach Btarget score 75

    Resolve all 2 CRIT.

  • A
    Reach Atarget score 95

    Resolve all 2 CRIT.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

crit
URL embeds a credential variable
The skill builds a URL that interpolates a secret into the query string. If the agent makes this request, the credential leaves the trust boundary.
rule: url-exfiltrationline: 622CWE-200
▾
620 openclaw browser --browser-profile openclaw start
621 openclaw browser --browser-profile openclaw open \
622 "https://chesswithclaw.vercel.app/Agent?id=$GAME_ID&token=$AGENT_TOKEN"← URL interpolates a credential into the query string
623
624Make moves:
crit
URL embeds a credential variable
The skill builds a URL that interpolates a secret into the query string. If the agent makes this request, the credential leaves the trust boundary.
rule: url-exfiltrationline: 665CWE-200
▾
6633. Open game:
664 browser-harness <<'PY'
665 new_tab("https://chesswithclaw.vercel.app/Agent?id=$GAME_ID&token=$AGENT_TOKEN")← URL interpolates a credential into the query string
666 wait_for_load()
667 print(page_info())
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-olckp2s9whmwabrxo0ble85g