T08 · Insecure Dependencies
Warning
- Location
docs/Threejs-Guide.md:31- Finding
Unpinned gltf-transform Package Retrieval and Execution in Three.js Guide
- Content
View full analysis
- Remediation
View remediation
Security audit
Game Quality Gates
Security checks for vulnerabilities and agentic risk
Overview
This is a game-development checklist skill with a supply-chain caution in its Three.js examples, but no hidden persistence, credential access, or unrelated behavior was found.
Before installing, be aware that this skill will load automatically for a wide range of game-development work. Treat the Three.js npx asset-compression commands as examples only: pin @gltf-transform/cli to a reviewed version or run an already installed local binary under a lockfile. Review the GitHub source before manual clone/update installs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/threejs.md:24- Finding
Repeated Unpinned gltf-transform Execution in On-Demand Three.js Reference
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Uninstalling
bash rm -rf ~/.openclaw/skills/game-quality-gates
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Uninstalling
bash rm -rf ~/.openclaw/skills/game-quality-gates
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says to activate the skill when 'building, reviewing, debugging, or deploying any game project,' which is a very broad set of ordinary activities rather than a narrowly defined trigger. It does not provide explicit trigger phrases, scope limits, or negative examples, so the skill could be invoked for many routine conversations about games.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The installation guide states the skill auto-triggers for broad categories such as building, reviewing, debugging, and deploying any game-related project. Broad activation increases the chance the skill influences unrelated or sensitive workflows without explicit user intent, which is risky because skill content must be treated as untrusted prompt material and can shape agent behavior in many contexts.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
The documentation instructs users to run
npx gltf-transformwithout pinning a package version, which can fetch and execute whatever the latest published package is at runtime. If the upstream package, dependency chain, or package name is compromised, users following the guide could execute attacker-controlled code on their development machine or CI environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
This command uses
npx gltf-transformwithout an explicit version, causing dynamic retrieval and execution of the current package release. In a developer guide, that creates a supply-chain risk because anyone following the instructions may unknowingly run a tampered or unexpected package version.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Running unpinned
npx gltf-transformfrom documentation introduces executable supply-chain exposure each time the command is used. Becausenpxmay resolve to the newest available package, a compromised release could lead to arbitrary code execution in local development or automated build contexts.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
The guide recommends invoking
npx gltf-transformwithout version pinning, which is unsafe because it executes code fetched from the package registry at runtime. In build and asset pipelines, this can become an entry point for dependency hijacking or malicious package updates affecting developers and CI runners.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
This final pipeline step also relies on unpinned
npx gltf-transform, preserving the same supply-chain execution risk across the full workflow. Since the skill is a prescriptive development guide, users are likely to copy-paste these commands directly, increasing the practical likelihood of exposure.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Rule 2: Respect Active Buffs ⚡ **Problem:** Code modifies speed/attack/size without checking if a temporary effect is active. Buff gets silently overwritten. **Solution:** Always use the current baseline (which may already be modified by buffs), not the raw base value.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The documentation instructs users to run
npx gltf-transformwithout pinning a specific package version, which can pull whatever version is current at execution time. That creates a supply-chain and reproducibility risk: a malicious or compromised upstream release, or even a breaking update, could execute unexpected code on the developer's machine during use.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
This command uses
npx gltf-transformwithout version pinning, so it depends on the latest package resolution at runtime rather than a reviewed, fixed artifact. In a developer-facing skill, that increases supply-chain exposure because running the example may download and execute unreviewed package code.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
Because the example uses
npx gltf-transformwith no pinned version, users may execute different code over time depending on the current registry state. If the package or one of its dependencies is compromised, this documentation becomes a delivery vector for arbitrary code execution in the developer environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The unversioned
npx gltf-transforminvocation makes the build/compression workflow non-deterministic and exposes users to upstream package changes at execution time. In practical terms, this can lead to compromised tooling, unexpected behavior, or broken asset pipelines if the latest release changes semantics.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
This final step in the pipeline also relies on
npx gltf-transformwithout a fixed version, so anyone following the documented process may fetch and run whatever package version is currently published. Sincenpxexecutes package binaries, a malicious release could directly impact the developer workstation or CI runner.- Content