Rock Paper Scissors Lizard Spock Game

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.0.0

Overview

This is a local game skill that stores a small gameplay stats file, with no evidence of credential access, exfiltration, or destructive behavior.

Install only if you are comfortable with the terminal version creating ~/.rpsls_stats.json to remember gameplay history. Prefer installing rich in a virtual environment instead of using --break-system-packages, and delete ~/.rpsls_stats.json if you want to clear the saved stats.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The skill instructs creating a persistent stats file in the user's home directory and reading it on startup. While this is limited to gameplay metadata, it introduces unnecessary local data storage and filesystem access for a simple entertainment skill, which creates privacy and data-retention concerns if done without explicit consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The example advertises automatic saving of gameplay statistics to a file in the user's home directory without clearly disclosing persistence, retention, or local privacy implications. While the stored data appears low sensitivity, silent persistence can surprise users, create unwanted local traces, and normalize writing user data to disk without informed consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example shows reading a local file from the user's home directory to display statistics, but it does not include a clear disclosure or consent step about accessing local user data. Even though the file is application-specific and likely low sensitivity, silent local-file access is a risky pattern because it can erode user expectations around privacy and data boundaries.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The README states that gameplay statistics are automatically saved to ~/.rpsls_stats.json, but it does not clearly frame this as persistent local data storage with privacy implications or provide opt-out guidance. While the stored data appears low sensitivity, undocumented persistence can surprise users on shared systems and may expose play history or behavioral patterns to other local users if file permissions are weak.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill advertises persistent statistics storage but does not give a prominent user-facing warning before creating the local file. Even low-sensitivity data should not be silently persisted, because users may not expect an entertainment skill to write to disk.

VirusTotal

65/65 vendors flagged this skill as clean.