Security audit

SteamedClaw Chess

Security checks for vulnerabilities and agentic risk

Overview

This skill locally analyzes chess FEN positions and prints candidate moves, with no evidence of networking, persistence, credential access, or unrelated system changes.

Install only if you want local chess move advice from supplied FEN strings. Quote FENs when invoking the command, review the chosen move before submitting it elsewhere, and expect higher depth settings to use more CPU; the skill should not need credentials or network access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a chess analysis capability: given a FEN, the skill should evaluate the position and return candidate moves with scores and stylistic labels. The supplied code does not perform analysis, search, evaluation, ranking, or style classification. Instead, it is an adapter/serialization layer that translates between internal chess engine data structures and external API formats such as board configs, FEN, move maps, piece symbols, and color strings. While this code is chess-related and FEN-adjacent, its primary purpose is materially different from the declared analytical behavior, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description emphasizes a chess position analysis feature that takes FEN and returns multiple top candidate moves with evaluations and style archetypes for personality-based selection. This code chunk instead provides backend AI search orchestration: it computes an effective search depth, applies difficulty settings and randomness, and calls a search engine to find the best move. While there is optional 'analysis' support mentioned for root move scores, this chunk does not implement multi-candidate style classification, personality-driven move picking, or explicit FEN parsing. Therefore the actual behavior only partially overlaps with the declared purpose and materially differs in its primary function and outputs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code is clearly chess-related, but it only provides a static board evaluation function for an already-built board object. It computes a numeric score based on material and piece-square tables, with special handling for checkmate and stalemate. The declared description promises a higher-level feature: taking FEN input, analyzing candidate moves, ranking them with evaluations, and adding style/personality annotations. None of those behaviors appear in this code chunk. While this evaluator could be a supporting component of such a system, the supplied chunk by itself does not accurately represent the declared end-user functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code is clearly chess-related, but it does not perform the user-facing analysis described. Instead, it provides internal heuristics for ordering already-generated moves during search: storing/checking killer moves, scoring captures via MVV-LVA, prioritizing TT moves and queen promotions, and selecting the next best move incrementally. There is no FEN input handling, no evaluation output, no candidate-move reporting, and no style/personality classification. This is a materially different primary purpose from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The code is clearly related to chess analysis, so the overall domain matches. However, the declared description promises a user-facing feature that takes FEN input and returns top candidate moves with evaluations plus style archetypes/personality-based move selection. This code chunk only performs low-level engine search on an already-constructed board object. It does not parse FEN, label moves by style archetype, or implement personality-based selection. Therefore the description overstates capabilities not present in the supplied code chunk, creating a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code is a backend optimization component for a chess engine, specifically a transposition table keyed by Zobrist hashes. It stores and retrieves previously evaluated positions, manages mate-score adjustments, chooses replacement strategy, and tracks cache statistics. While this is chess-related and may support a larger analysis engine, it does not itself perform the declared user-facing function of taking a FEN and returning top candidate moves with evaluations and style labels. The primary purpose is materially different: search-performance caching rather than chess position analysis output. No suspicious extra permissions or external resource access are present, but the described capability is not accurately represented by this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code is chess-related, but it does not do what the description claims. Instead of analyzing a FEN and returning recommended moves with evaluations and stylistic labels, it provides internal engine mechanics for attack detection and check validation using bitboards. These functions are supporting components of a chess engine, not a complete position-analysis skill. There is no evidence of FEN ingestion, candidate move ranking, evaluation output, or personality/style-based move selection. Therefore the declared description materially overstates and misrepresents the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code is clearly chess-related, but it does not implement the declared user-facing behavior of analyzing a FEN position and returning top moves with evaluations and personality/style labels. Instead, it provides internal board data structures and helper functions for piece placement, board copying, and occupancy/color checks. These are supporting engine primitives, not the described analysis functionality. Because the declared purpose is a high-level analysis service while the actual code chunk is a low-level board representation module with none of the stated analysis capabilities present, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a user-facing chess analysis capability that accepts FEN input and returns best moves with evaluations and stylistic labels. The supplied code does not do analysis or recommendation; it is an internal engine component for generating legal moves and applying them to a board representation. It also updates engine state such as zobrist hashes, castling rights, en passant state, and check flags. While this is chess-related and could support a larger analysis system, the actual primary behavior of this chunk is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code is chess-related, but its function is a foundational engine utility module rather than a complete position-analysis skill. It computes attack bitboards and sliding piece rays, which are supporting internals for move generation. The declared description promises user-facing analysis from FEN input, returning best candidate moves with evaluations and style labels. None of those higher-level behaviors appear in this code chunk. There is no evidence of input handling, FEN decoding, search, evaluation, or personality/style-based recommendation. Therefore the description materially overstates and misrepresents what this supplied code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code is a low-level internal chess-engine utility for hashing board positions, likely to support transposition tables. It does not parse FEN, search positions, generate legal moves, rank candidate moves, produce evaluations, or assign styles such as solid/aggressive/speculative. While it is chess-related, its primary purpose is materially different from the declared user-facing analysis capability, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description frames the skill as an analysis-only assistant: give a FEN, receive top candidate moves with evaluations and style labels so a personality can choose. The actual code is broader and materially different. It exposes a full chess engine API with stateful game management, legal move generation, move application, piece placement/removal, history, FEN/status export, and console printing. While the ai() method can optionally return scored moves for analysis, the code primarily supports playing/managing chess positions, not just analyzing them. Additionally, the claimed style archetypes (solid/aggressive/speculative) and personality-based selection are not implemented anywhere in the shown code. Therefore the description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code chunk is merely a supporting internal type definition for chess-engine AI search, specifically transposition table entry kinds. On its own, it does not implement the declared end-user functionality of analyzing a chess position and returning ranked moves with evaluations and stylistic archetypes. Because the declared purpose describes a complete analysis feature while the actual code shown is only a low-level enum unrelated to that user-facing behavior, this is a material description-behavior mismatch for the supplied chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a functional chess analysis capability. However, this code chunk is only a low-level type definition file containing enumerations for chess pieces and colors. While such types could support a chess engine, this specific code does not itself perform the advertised behavior. Therefore, the supplied code chunk does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This code chunk is an index file that aggregates and re-exports type modules. Its primary purpose is package/module organization, not runtime chess analysis. While the exported types may support a chess engine elsewhere, the supplied code itself does not implement the declared behavior of analyzing positions and returning ranked moves with evaluations and style labels. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises a user-facing chess analysis capability that takes a FEN and returns recommended moves with evaluations and style labels. The supplied code chunk only contains static type/enum definitions used internally by a chess engine. While these definitions are related to chess move representation and could support an engine, this chunk does not implement the declared behavior or any user-facing analysis flow. Therefore the actual behavior in this code does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a user-facing chess analysis capability: given a FEN, the skill should compute and return candidate moves with evaluations and stylistic labels. The supplied code chunk is merely a constants module containing board and castling metadata used by a chess engine. While these constants are related to chess and could support a larger engine, this chunk by itself does not implement the declared behavior. Therefore the actual behavior shown is materially narrower and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code is chess-related, but it does not perform the declared skill behavior of analyzing a position and returning recommended moves with evaluations and styles. Instead, it provides foundational board-representation utilities for converting between algebraic squares, indices, and bitboards, plus helper calculations. These are supporting engine internals, not a position-analysis feature. There are no undeclared sensitive capabilities or permissions, but the primary purpose is materially narrower and different from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a chess analysis skill, but the supplied code chunk contains only generic environment detection helpers and a function to choose a default transposition table size depending on runtime. While transposition tables can be related to chess engines, this code does not analyze FEN positions, compute candidate moves, produce evaluations, or map moves to style archetypes. Its primary purpose is environment/runtime configuration, which is materially different from the declared end-user functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a user-facing chess analysis feature: given a FEN, it should identify top moves, provide evaluations, and classify move styles. The supplied code does none of that. It implements low-level FEN utilities: parsing piece placement and metadata, validating syntax and basic legality, converting board state back to FEN, and returning the standard starting FEN. While FEN parsing is related to chess and could support a later analysis pipeline, this chunk’s actual behavior is materially narrower and different from the declared primary purpose. There are no suspicious extra permissions or unrelated external accesses, but the description significantly overstates the implemented capabilities.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is described as FEN-based position analysis, but this file exposes broad stateful game-management functionality including move execution, history, board mutation, console output, and AI play. This expands the skill's effective capability beyond its declared purpose, increasing attack surface and making it easier for downstream callers or prompt-injected workflows to perform unintended stateful actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The public setPiece and removePiece methods allow arbitrary board editing even though the skill's stated purpose is to analyze positions from supplied FENs. In this context, hidden mutation primitives are dangerous because they let callers bypass expected input constraints and repurpose the skill for undeclared capabilities, undermining least privilege and increasing misuse potential.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest promises top candidate moves with evaluations and style archetypes like solid, aggressive, and speculative. The analysis path here returns scored moves, depth, nodes searched, and best score, but no style classification or personality-oriented archetype labeling is produced.
Content: No source excerpt is available for this finding.