Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward guide for uploading a browser game to an external game-hosting API, with no hidden code or persistence.
Before installing, understand that using this skill may upload your game files to a third-party service and produce a public game URL. Only upload files you intend to publish, and confirm the gameFolder and destination endpoint before running the curl commands.
The skill instructs uploading local files to an external domain and publishing a game URL, but it does not clearly warn that data leaves the local environment and may become externally accessible. This can lead users or downstream agents to exfiltrate local workspace files or unintentionally publish proprietary content.
The document first presents an 'Important Rule' that existing files cannot be overwritten and that the interface will error if a file exists. Later, it says overwriting is possible via a general interface with overwrite=true, which contradicts the earlier absolute statement about overwrite behavior and changes the implied operational intent.
This is an explicit prohibition on a particular language script in natural-language instructions, without explaining that the limitation is purely technical or offering user choice. SQP-3 covers language or locale policy violations when a skill forces or excludes specific languages without opt-in or clear justification.
The instruction 'use English' is a natural-language locale restriction, and the file does not offer a language choice or explain a necessary region-specific justification. Under SQP-3, forcing a specific language without user opt-in can violate language or locale policy.
No suspicious patterns detected.
