Security audit

Autogame Tales

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small story generator, but it can load unaudited external JavaScript and can write files outside its stated storage area.

Review before installing. The story-generation function is simple, but this package should not be run in a sensitive workspace unless the Feishu helper path is trusted or removed, the genre argument is allowlisted, and outbound recipients are explicit and validated.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:48
Finding: Path Traversal Through Unvalidated Genre Argument
Content: View full analysis
{ console.error(err); process.exit(1); }); ``` ### Technical Analysis The value following `--genre` is accepted directly from the command line and interpolated into a filesystem path. The code does not restrict the value to the keys in `GENRES`, remove path separators, or verify that the resolved destination remains inside `TALES_DIR`. Although `path.join()` normalizes paths, it does not prevent traversal. A genre containing components such as `../` can cause the resulting filename to resolve outside `../../memory/tales`. The appended timestamp prevents an attacker from choosing the exact final filename, but it does not prevent unauthorized file creation in another writable directory. The story body also incorporates the supplied genre, allowing the attacker to influence part of the written content. ### Attack Path 1. An attacker obtains the ability to invoke the skill or influence its command-line arguments. 2. The attacker supplies a genre containing traversal components, for example: ```bash node index.js --genre ". ...[truncated 1094 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: index.js:5
Finding: Execution of an Unpinned Component From Outside the Audited Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs an outbound messaging action via a dynamically loaded external Feishu helper even though its apparent purpose is local story generation. This creates an unnecessary data egress channel: generated content and execution context can be sent to an external recipient controlled by environment variables, which is risky in an agent skill because it expands behavior beyond the stated task and could be repurposed for covert exfiltration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code selects a message recipient from environment variables, allowing runtime configuration of where outbound content is sent without validation. In an agent environment, this makes the exfiltration path more flexible and harder to audit, since an attacker or misconfigured runtime can redirect messages to an unintended recipient.
Content: No source excerpt is available for this finding.