Security audit

dnd5e-dm-general

Security checks across malware telemetry and agentic risk

Overview

This D&D dungeon-master skill is mostly game-related, but it also grants broad personal-assistant, background-monitoring, file-writing, deletion, and publishing powers that are not well scoped to gameplay.

Install only in an isolated game workspace. Expect it to create, read, update, and sometimes delete local game files. Do not give it access to email, calendar, social accounts, broad memory files, or repository push permissions unless you explicitly want a general personal assistant. Avoid loading untrusted save files until the scene-cache path handling is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: `extract_scene_cache()` trusts `_scene_cache_file` from untrusted save data and joins it directly with the current working directory before writing. An attacker-controlled save can supply path traversal values such as `../...` or absolute paths, causing arbitrary file write outside the intended cache namespace and potentially overwriting application files or user data.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: These instructions broaden the skill from a D&D dungeon-master into a general personal-assistant with permission to search the web, inspect calendars, and operate across the workspace. That creates unnecessary authority and data exposure well outside the declared skill scope, increasing the chance of privacy violations and unsafe side effects if the skill is invoked in the wrong context.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The heartbeat section authorizes ongoing monitoring of email, calendar, social notifications, weather, memory maintenance, and proactive outreach, none of which are necessary for a D&D DM engine. This effectively turns the skill into a persistent surveillance/assistant agent that can access sensitive personal context and act autonomously beyond user expectations.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The startup protocol instructs the agent to scan a hard-coded path on a local drive outside the declared workspace. Even if intended for game saves, this is still local file access beyond the skill boundary and can reveal filesystem contents or metadata without an explicit per-session consent prompt.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Allowing the skill to commit and push changes introduces outbound publishing capability unrelated to running a D&D session. This can exfiltrate data, publish unintended changes, or alter repositories autonomously, which is especially dangerous when combined with broad workspace and memory access.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The guide explicitly instructs the agent to fall back to manual local terminal execution when Python cannot be run. That expands the skill from a bounded game-management role into directing host-side operations, which can lead to unsafe command execution or social-engineering of the operator into performing actions outside the intended trust boundary.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The document directs the skill to call a localhost HTTP API for SRD lookup, giving the skill network-capable behavior beyond pure prompt logic. Even though the target is localhost, this still crosses a boundary into external service interaction and can expose local services, leak prompts or data, or create unintended side effects if the endpoint behavior changes.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: 规则20定义了对玩家现实情绪、低活跃度和私人主题进行映射、分级和延后触发（P0-P5），这超出了D&D地下城主技能的核心用途，并形成了对敏感个人状态的行为分析。即使声明“本地存储”，该设计仍会诱导系统收集、推断并持久化心理/生活信息，带来隐私越界和不当情绪干预风险。

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The document claims the feature is handled entirely in-character by the LLM without scripting, yet elsewhere specifies automatic persistence of unfinished side quests and emotion-derived themes to themes.json. That inconsistency can obscure that user disclosures may be stored, which is security-relevant because the content involves sensitive emotional and personal-life signals.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly documents automatic save creation and persistent state writes, but does not prominently warn users that invoking normal gameplay features will modify local files. Hidden or under-disclosed data modification is risky because it can overwrite state, leak sensitive content into saves, or surprise users in restricted environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented initialization process creates directories and files in the working directory, but the markdown does not foreground this as a potentially system-modifying action. In environments where users expect a passive chat skill, silent workspace initialization can lead to unauthorized file changes and reduced trust.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file authorizes scanning a specific local save directory but does not present a user-facing warning or consent flow about accessing local files. That undermines informed consent and may surprise users by reading files automatically at conversation start.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The guide instructs immediate updates to a workspace tracking file whenever new filler content is used, without any warning that persistent files will be modified. Silent or automatic file writes can surprise users, overwrite expected state, and normalize broad write behavior from a prompt-only skill.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The automatic module-build workflow instructs the system to parse module files and generate several new workspace artifacts, but does not warn that multiple files will be created. This increases the risk of unreviewed file creation, state sprawl, and accidental modification of the user's working directory beyond what they expect from a DM skill.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The localhost API guidance omits privacy and disclosure warnings even though it sends query data to an HTTP service. Users may not realize that prompts, search terms, or contextual data are being transmitted to another process, which can be logged, retained, or handled by a different trust domain.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The release workflow includes deleting files deemed temporary, duplicate, or valueless without an explicit user warning or confirmation step. Deletion guidance in an agent skill is risky because misclassification or prompt-influenced decisions can destroy useful project files and make recovery difficult.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The combat cleanup procedure mandates deleting temporary Python files and removing combat_state.json after battles, without disclosure or confirmation. This creates a direct destructive file-operation pattern: a prompt-driven agent may erase files from the workspace, potentially including valuable state or misidentified scripts, and the mandatory wording increases the chance of unsafe execution.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: 启动协议要求在每次新对话时扫描并读取本地 `saves/` 下的存档文件，但未先向用户明确告知将进行本地文件访问，也未先取得同意。对一个聊天型DM技能而言，静默枚举和读取本地文件会暴露文件名、游戏进度和可能嵌入的自由文本内容，构成不透明的数据访问。

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: 规则要求启动时扫描工作目录中的 `saves/`，并修改 `world_state.json['echo_enabled']`，但没有任何前置告知或授权流程。这既包括本地文件读取，也包括状态文件写入；在未经明确同意的情况下自动修改本地状态，会让用户失去对数据访问和持久化行为的预期控制。

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The template directs the agent to automatically create, update, embed into saves, restore from saves, and delete `_scene_cache_*.json` files under a fixed local path without any user disclosure or consent. In an agent setting, silent file-system side effects can expose local environment details, overwrite existing files, persist hidden state across sessions, and surprise users who only expected conversational output.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file describes automatic local storage of player emotion records and unfinished side-quest state without a clear retention notice, consent mechanism, or lifecycle policy. Because the stored material can encode sensitive mental-state and personal-context inferences, silent retention increases privacy risk even if data is only local.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.