Security audit

dnd-dm

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a local D&D game engine, but it includes unrelated personal-assistant instructions and sensitive persistence that should be reviewed before installation.

Install only in a dedicated D&D workspace, not a general personal-agent workspace. Before enabling it, remove or ignore the bundled AGENTS.md heartbeat/personal-assistant instructions, back up existing saves and module files, and do not use echo-map with sensitive real-life stories unless you are comfortable with local derived data being stored.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and documents shell, Python, file read/write, and environment-dependent behavior, but does not declare corresponding permissions. That creates a transparency and sandboxing gap: users and hosting platforms cannot accurately assess what the skill may access or modify before invocation. In this context, the skill also persists saves and launches local services, making undeclared capabilities materially relevant rather than theoretical.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The declared description frames the skill as a D&D DM engine, but the documented behavior extends into processing real personal stories, anonymization workflows, RAG retrieval, and module-generation pipelines. This mismatch can mislead users about what data is processed and what operations occur, undermining informed consent and safe deployment review. Because the extra functions handle potentially sensitive personal narratives, the mismatch increases privacy and trust risk.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation states the LLM must not generate Python scripts, yet elsewhere instructs direct execution of Python scripts for subskills and pipelines. Contradictory execution guidance weakens safety boundaries and can lead agents to bypass intended controls by invoking arbitrary local scripts under the banner of documented behavior. In a skill with shell and file capabilities, that inconsistency increases the chance of unsafe code execution paths.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: These instructions expand the skill far beyond a D&D dungeon-master role into broad workspace, web, communication, and organizational capabilities. In a skill context, this creates scope creep that can cause the agent to access unrelated local or external resources and act on sensitive user data under the guise of normal operation.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The heartbeat section authorizes ongoing monitoring of email, calendar, social mentions, weather, and project state, none of which are required for a D&D DM skill. This effectively turns the skill into a proactive personal assistant with surveillance-like behavior and repeated access to sensitive data sources without per-task user consent.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The guide instructs runtime access to a localhost HTTP service for SRD lookups via urllib. Even though the target is localhost, this is still network-style IPC that expands the skill's attack surface, creates hidden service dependencies, and could be abused if a different process is bound to that port or if request parameters are not constrained.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: These rules expand the skill from running a D&D game into handling users' real-life emotional disclosures and mapping them into persistent gameplay state. That creates collection and processing of sensitive personal data unrelated to the core DM function, increasing privacy and safety risk if users reveal distress, health, work, or relationship information.

Context-Inappropriate Capability

Low

Confidence: 72% confidence
Finding: The skill directs the agent to perform local environment verification and installation guidance via a local API, which goes beyond ordinary narrative gameplay and adds operational capability. While not inherently hostile, it broadens the skill's access pattern and can expose local system details or normalize non-game system interactions without clear necessity.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The document defines `themes.json` as automatic storage for player emotion records, which expands the skill from a game engine into persistence of sensitive personal data. Even if described as local-only, storing emotional themes creates privacy and profiling risk, especially because the content may include mental-health-adjacent disclosures and users are not clearly informed or asked for consent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly supports transforming real personal experiences and names/places into D&D content, but does not prominently warn users about privacy risks, residual identifiability, or where such data may be stored or transmitted. Anonymization is not equivalent to guaranteed de-identification, so users may disclose sensitive personal or third-party information under a misleading sense of safety. The risk is heightened because the feature is positioned as a convenient pipeline rather than a sensitive-data workflow.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The documentation describes automatic creation and updating of local save, combat-state, party, cache, and port files, but does not clearly warn users that their data will persist on disk. Hidden persistence can expose campaign content, personal notes, or derived story data to other local users, backups, or later processes. The impact is limited compared with remote exfiltration, but it is still a real privacy and integrity concern.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: `init_module()` unconditionally writes `MODULE_INDEX.md`, `MODULE_ARC.md`, and `world_state.json` into the project root, replacing any existing files. In an agent skill context, this can destroy prior state, overwrite user-maintained content, or reset game/session data if invoked with an unexpected module selection or at the wrong time.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The rebuild function unconditionally overwrites a fixed filename, live_party.json, in the current working directory. In an agent or multi-component environment, this can destroy existing state, create cross-session data leakage/confusion, or overwrite an unintended file target if the working directory is shared or attacker-influenced.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The startup protocol requires scanning a local save directory before user selection, which causes file-system access without first obtaining informed consent in the conversation. Even if the target path is intended for game saves, automatic enumeration of local files is a privacy-sensitive action and may reveal metadata or unrelated content if the path is broader than expected.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill instructs saving the created character to `saves/characters/[角色名].md` only after the final confirmation step, but it does not clearly warn users earlier that their inputs will be persisted. This is a real privacy/transparency issue because users may provide names or other identifying details during the flow without understanding that the data will be stored locally.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The guide requires automatic updates to filled_content.md whenever new content is used, but does not require user awareness or consent for filesystem writes. Silent state mutation can surprise users, overwrite expected data, and make rollback or auditing difficult in shared or sensitive working directories.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document directs automatic construction of multiple MODULE_* files in the working directory at module startup without clear notice or confirmation. Unprompted file creation increases the local data footprint, can clutter or overwrite project directories, and may expose module-derived content in places users did not expect.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Module initialization is defined to auto-generate runtime state files such as world_state.json and scene indexes, again without explicit disclosure of the persistence behavior. This can create unintended retention of gameplay data and unexpected modification of the user's workspace.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The guide mandates scanning for generated .py files and deleting them, plus cleanup of state files, before release. Broad deletion logic based on filename patterns or loose classification is dangerous because it can remove legitimate files, destroy forensic artifacts, or cause data loss without informed consent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: Post-combat cleanup instructs scanning the working directory for temporary Python files and deleting combat_state.json remnants. This is destructive behavior in a normal runtime path, and if implemented loosely it can delete unrelated files, break recovery/debugging, or erase state users expected to keep.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The rules require scanning local save files at the start of a new session without a clear upfront notice that local files will be accessed. Even if expected in a save/load feature, silent directory enumeration is a privacy concern because it accesses user-local data before meaningful consent in the conversation.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The rules direct automatic persistence of user-related state to local files, including gameplay/session preferences, without a clear privacy or retention notice. Automatic storage is risky when users may not realize state is being written, how long it remains, or how it will be reused later.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill permits persistent storage of sensitive real-life themes derived from user disclosures without an explicit warning or informed consent. This is dangerous because it converts potentially intimate or emotional disclosures into retained personal profiling data, which is outside the expected scope of a dungeon-master tool.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The template directs the system to automatically create, update, restore, and delete `_scene_cache_*.json` files under a fixed local path without any user-facing notice or consent. In an agent setting, undocumented file writes and deletions increase the risk of unintended persistence, data leakage through saves, and accidental tampering with local files if path handling or location names are not tightly controlled.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Automatic storage of player emotional records without a clear, up-front warning or consent mechanism is a privacy and sensitive-data handling flaw. Users may disclose vulnerable personal information in a roleplay context without realizing it will be retained, creating risk of unintended retention, later exposure, or secondary use.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/lens_pipeline.py:42