Security audit

PASM Game NPC Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent game NPC helper that clearly discloses local memory persistence, with ordinary but notable dependency-installation and privacy considerations.

Install in a virtual environment under a normal user account, prefer a pinned reviewed package version over the source-install fallback, and avoid putting sensitive real user data into NPC interactions unless you are comfortable with it being saved locally under ~/.pasm-agents/.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:92
Finding: Unpinned Third-Party Python Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 64-65, 92, and 182 **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown | **pasm-skills** (base) | Provides capabilities only, **without any agents** | `pip install pasm-skills` | | **pasm-agents** (skill source) | Game NPC / elder companion / learning companion + 7 verification agents | `pip install pasm-agents` | ``` ```bash pip install pasm-agents # Automatically installs pasm-skills ``` ```markdown | `bionic` | Full PASM core + emotion module (requires torch) | `pip install pasm-agents[torch]` | ``` ### Technical Analysis The documented installation commands do not pin package versions or verify package hashes or signatures. Consequently, installation resolves whichever package artifacts and transitive dependencies are published at execution time. Python package installation may execute package-controlled build backends, setup hooks, and generated commands. The code of `pasm-agents`, `pasm-skills`, optional dependencies such as `torch`, and their transitive dependencies is not included in the audited project. Their installation-time and runtime behavior therefore cannot be verified from `SKILL.md`. This creates a supply-chain exposure: compromise of an upstream publisher account, package release, build pipeline, or dependency could cause a future installation to retrieve attacker-controlled code. ### Attack Path 1. An attacker compromises an upstream package publisher, release pipeline, or transitive dependency. 2. The attacker publishes a malicious package version under a dependency name referenced by the documentation. 3. A user follows an unpinned `pip install` instruction. 4. Package resolution selects the malicious or compromised release. 5. Pip invokes attacker-controlled installation or build logic, or installs code that executes when the ...[truncated 719 chars]
Remediation: ## Remediation Suggestions 1. Pin every direct dependency to a specifically reviewed version. 2. Generate a lock file that records all transitive dependency versions. 3. Publish SHA-256 hashes for approved distributions and install with pip's `--require-hashes` option. 4. Prefer signed, reproducible releases and document how users can verify package provenance. 5. Review package build metadata and installation hooks before approving a release. 6. Install dependencies inside an isolated virtual environment using a non-privileged account. 7. Add automated dependency vulnerability, provenance, and integrity checks to the release process. 8. Repeat the audit whenever a pinned dependency or its verified artifact changes.

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:94
Finding: Mutable Remote Repository Retrieval and Editable Installation## Vulnerability Details **File Location**: `SKILL.md`, line 94 **Vulnerability Type**: Retrieval and execution of unpinned remote source code **Risk Level**: Medium ### Vulnerable Code ```bash # git clone https://gitee.com/arronzheng/pasm-agents && cd pasm-agents && pip install -e . ``` ### Technical Analysis The alternative installation instruction clones the current default branch of an external repository and immediately performs an editable installation. It does not identify a reviewed commit, require a signed tag, or verify the downloaded content against an expected checksum. Because a repository's default branch can change after this skill has been reviewed, the effective installed payload is mutable. The remote source is not included in the audited project, so its packaging configuration, build hooks, imported modules, and runtime behavior could not be inspected. Although the line is presented as a commented example rather than an automatically executed command, a user following the documented fallback procedure would retrieve and install external code without integrity verification. ### Attack Path 1. An attacker compromises the remote repository, a maintainer account, or the repository's delivery infrastructure. 2. The attacker modifies the default branch to include malicious packaging hooks or runtime code. 3. A user copies and runs the documented fallback command. 4. Git retrieves the attacker-controlled default branch because no reviewed commit is specified. 5. `pip install -e .` processes the repository's packaging configuration and creates an editable installation. 6. Malicious build-time code executes during installation, or malicious runtime code executes when the installed package is imported or invoked. ### Impact Assessment Exploitation could result in arbitrary code execution with the privileges of the user running the command. An attacker could read or modify user-accessible ...[truncated 339 chars]
Remediation: ## Remediation Suggestions 1. Replace the mutable default-branch clone with a specific, reviewed commit hash or signed release tag. 2. Verify the checked-out commit and downloaded source against an independently published signature or checksum before installation. 3. Avoid recommending editable installation for end users; build and distribute an immutable, reviewed artifact instead. 4. Use shallow, detached checkouts of the approved revision where source installation is unavoidable. 5. Review packaging files and build hooks at the pinned revision before publishing the instruction. 6. Perform installation in an isolated environment under a non-privileged account. 7. Update the documented revision only after a new security review.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The natural-language instructions and usage guidance are presented exclusively in Chinese, which effectively forces a specific language for users of the skill documentation. Under the policy, this is a language/locale constraint that should either be optional for users or explicitly justified as region-specific.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly states that agent state is persisted under ~/.pasm-agents/<id>/ and that NPCs remember player interactions, but it does not clearly warn users that potentially sensitive conversation and player-behavior data will be written to disk automatically. In a game or local-agent context this creates a real privacy and data-handling risk, especially on shared machines or when developers assume interactions are ephemeral.

Static analysis

No suspicious patterns detected.