阴阳岛肉鸽

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

An agent could make moves or reset the game through the documented interface, but the artifacts do not show real-world account, file, or system changes.

Why it was flagged

The skill documents an AI-facing interface for reading game state and performing game actions. This is aligned with an AI-playable game and appears limited to gameplay.

Skill content

使AI Agent能够：
1. 读取游戏当前状态
2. 分析局势并做出决策
3. 执行游戏动作

Recommendation

Keep any AI controls limited to in-game actions and ask the user before resetting or substantially changing a game session.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Opening the game may contact Google Fonts, revealing normal web request metadata such as IP address and user agent.

Why it was flagged

The local HTML page depends on a Google-hosted font. This is common for visual styling, but it is still an external dependency not mentioned in SKILL.md.

Skill content

@import url('https://fonts.googleapis.com/css2?family=Press+Start+2P&display=swap');

Recommendation

If fully offline play or avoiding third-party requests matters, bundle the font locally or remove the external import.