Security audit
Security checks for vulnerabilities and agentic risk
This is a simple game-publishing guide with disclosed external uploads and no bundled code, persistence, or hidden privilege behavior.
Before installing or using this skill, confirm that any files uploaded are the intended game assets and do not contain secrets, private data, or unintended local content. Treat overwrite=true as a destructive remote update that should require explicit user approval.
The skill instructs users or agents to upload local files to an external domain without any warning, consent checkpoint, or data-sensitivity guidance. In an agent setting, this can lead to unintended exfiltration of user-provided or locally available content to a third-party service.
The document recommends using a general interface with overwrite capability but does not warn about destructive effects, confirmation requirements, or rollback limitations. This increases the risk of accidental replacement of existing content, especially if an automated agent follows the guidance without human review.
L027 states that the game folder name must 'use English,' which imposes a language constraint in the skill instructions. Because the document does not present this as an optional user choice or clearly justify it as a strict platform requirement, it appears to violate the language/locale policy criterion.
L155 requires English letters and says not to use Chinese characters or spaces, which is a language/locale restriction stated as a rule. The file does not clearly document why this restriction is required by the platform or provide user opt-in, so it matches the policy-violation category.
Line L163 claims the Step 1 config.json example contains an "address" field used as a note, but the actual example at L104-L106 only shows a malformed JSON object with a title field and missing structure. This is an active contradiction between the inline documentation note and the referenced content.
No suspicious patterns detected.
