boardgame-rulebook-zh

• Outcome: Review
• Latest audit: Oct 27, 2026 · 2:05 PM UTC
• Version: 1.0.1

Overview

The skill fits its translation purpose, but its cleanup can permanently delete existing files without warning.

Use fresh, dedicated output and self-test directories, and keep backups. Existing qa folders and several self-test folders can be deleted automatically. Ask the publisher to add ownership checks and explicit overwrite protection, and use a tested dependency set with current security fixes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

Drop the whole directory into the agent's skills directory, e.g. for Qoder:

text

~/.qoder-cn/skills/boardgame-rulebook-zh/SKILL.md

Or install it following the ClawHub/OpenClaw skill directory convention.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 73)May include surrounding context.

把整个目录放到 Agent 的 skills 目录即可，例如 Qoder：

text

~/.qoder-cn/skills/boardgame-rulebook-zh/SKILL.md

或按 ClawHub/OpenClaw 的 skill 目录规范安装。

Activation examples include generic requests without a board-game PDF constraint.

Medium

• Category: Trigger Abuse
• Confidence: 93% confidence

Finding

The instruction includes “terminology must be accurate” and “images must not shift” among requests that should activate this skill. These phrases also apply to unrelated translation and layout tasks, and the activation instruction does not explicitly require an English board-game PDF intended for Chinese localization.

Content

No source excerpt is available for this finding.

The activation list includes generic requests for accurate terminology or correctly aligned images without requiring a board-game rulebook translation context.

Medium

• Category: Trigger Abuse
• Confidence: 96% confidence

Finding

The activation guidance includes generic requests such as accurate terminology and correctly aligned images without explicitly requiring a board-game rulebook translation task. An agent following this wording literally could select this skill for unrelated work, allowing its workflow to influence tasks outside its intended scope. The surrounding documentation consistently describes rulebook translation, which reduces the ambiguity; there is no evidence here of malicious redirection or data theft.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · examples/selftest.py (reported line 28)May include surrounding context.

python

def run(cmd: list[str], cwd: Path) -> subprocess.CompletedProcess:
    env = dict(**__import__("os").environ)
    env["PYTHONIOENCODING"] = "utf-8"
    result = subprocess.run(cmd, cwd=str(cwd), text=True, encoding="utf-8",
                            errors="replace", capture_output=True, env=env)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · examples/selftest.py (reported line 30)May include surrounding context.

python

def run(cmd: list[str], cwd: Path) -> subprocess.CompletedProcess:
    env = dict(**__import__("os").environ)
    env["PYTHONIOENCODING"] = "utf-8"
    result = subprocess.run(cmd, cwd=str(cwd), text=True, encoding="utf-8",
                            errors="replace", capture_output=True, env=env)
    if result.returncode != 0:
        print(result.stdout)

Self-test recursively deletes existing output subdirectories without disclosing the destructive cleanup.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The --out argument selects a base directory, after which positive_test recursively deletes existing work and out subdirectories without checking that they belong to this self-test or obtaining overwrite consent. If a user or agent selects an existing project directory, unrelated contents in those subdirectories can be permanently lost; negative_test performs similar cleanup of work_bad and out_bad. Cleanup is reasonable for a PDF test harness, but the lack of ownership checks makes reuse of an existing output location unsafe.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/extract.py (reported line 1059)May include surrounding context.

python

metadata = doc.metadata or {}
    return {
        "version": VERSION,
        "created_at": __import__("datetime").datetime.now().astimezone().isoformat(timespec="seconds"),
        "pdf_path": str(pdf_path),
        "pdf_sha256": file_sha256(pdf_path),
        "pdf_size": pdf_path.stat().st_size,

The existing QA directory is recursively deleted without disclosing that all of its contents will be removed.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The script unconditionally deletes the entire existing /qa directory with shutil.rmtree(), without checking that its contents were generated by this tool or obtaining confirmation. Selecting an output directory whose qa subdirectory contains unrelated files can therefore cause irreversible data loss, even with --no-previews. Regenerating QA artifacts is legitimate for this skill, which limits the scope of concern, but does not justify silently removing arbitrary pre-existing contents.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: PyMuPDF has 2 known advisory(ies) (CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: Pillow has 197 known advisory(ies) (CVE-2026-112390 (Pillow: Infinite loop in MIC n_frames when the embedded TIFF); CVE-2026-96638 (Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / ab); CVE-2026-112391 (Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tr) +194 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Pillow>=8.4,<13 permits obsolete releases with known image-processing vulnerabilities, making this a dependency-policy weakness, although the installed version is not provided. Handling external rulebooks and their images makes malformed-media attacks relevant, potentially causing resource exhaustion or other decoder-specific effects. The advisory count and listed identifiers do not independently establish that a particular installation is exploitable.

Content

No source excerpt is available for this finding.