阴阳岛肉鸽

ReviewAudited by ClawScan on May 10, 2026.

Overview

Prompt-injection indicators were detected in the submitted artifacts (unicode-control-chars); human review is required before treating this skill as clean.

This skill looks safe to try as a local browser game. Be aware that it may load a font from Google, and the provided index.html excerpt is truncated, so reviewing the full HTML is still prudent if you need high assurance. ClawScan detected prompt-injection indicators (unicode-control-chars), so this skill requires review even though the model response was benign.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

An agent could make moves or reset the game through the documented interface, but the artifacts do not show real-world account, file, or system changes.

Why it was flagged

The skill documents an AI-facing interface for reading game state and performing game actions. This is aligned with an AI-playable game and appears limited to gameplay.

Skill content

使AI Agent能够：
1. 读取游戏当前状态
2. 分析局势并做出决策
3. 执行游戏动作

Recommendation

Keep any AI controls limited to in-game actions and ask the user before resetting or substantially changing a game session.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Opening the game may contact Google Fonts, revealing normal web request metadata such as IP address and user agent.

Why it was flagged

The local HTML page depends on a Google-hosted font. This is common for visual styling, but it is still an external dependency not mentioned in SKILL.md.

Skill content

@import url('https://fonts.googleapis.com/css2?family=Press+Start+2P&display=swap');

Recommendation

If fully offline play or avoiding third-party requests matters, bundle the font locally or remove the external import.