Security audit

structs-intel

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Structs game-scouting guide that uses read-only queries and openly stores competitive intel for later sessions.

Install only if you want your agent to collect and retain Structs competitive scouting notes. Keep memory/intel/ private, periodically delete stale target profiles, and avoid storing more opponent detail than you need.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly instructs persisting per-target intelligence in `memory/intel/`, including player IDs, guild ties, behavioral profiling (`archetype`), ore holdings, and operational raidability signals such as command ship status and shield vulnerability, without any warning about retention, access control, minimization, or safe handling. In an agent environment where memory survives context resets, this creates a durable profiling dataset that could be misused by later sessions, other skills, or unauthorized users, and the competitive/targeting context makes the data more sensitive than ordinary cache data.

Static analysis

No suspicious patterns detected.