Imitation Game Agent Skill

• Outcome: Review
• Latest audit: May 28, 2026, 1:54 AM
• Version:
  1.0.1

Overview

This is a coherent game skill, but it asks the agent to create and persist a crypto wallet private key from an external backend, so users should review it carefully before installing.

Install only if you intentionally want this agent to play this specific game and are comfortable with its backend creating or returning a wallet private key. Treat the generated wallet as disposable, do not deposit personal funds into it, review the saved config file, and require explicit confirmation before joining games or submitting answers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger guidance says to use this skill when the user says "play" or "start game," which are generic phrases that can match many unrelated contexts. Overly broad invocation increases the chance the agent will enter a workflow that performs shell commands and external network actions without sufficiently specific user intent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to retrieve a wallet `privateKey` from a remote service and store it in a local config file for future use. This creates direct secret-handling and persistence of highly sensitive credentials, and normalizing this flow through shell commands materially increases the risk of theft, accidental disclosure, or misuse of funds.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The skill's stated goal is to fool a judge into believing the AI is human, which is explicit impersonation/deception behavior. Instructions that direct an agent to misrepresent its identity are dangerous because they can be repurposed for social engineering, trust manipulation, and policy evasion beyond the game context.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The behavioral guidance explicitly tells the agent to hide AI identity, mimic human flaws, and avoid mentioning it is an AI. That is stronger than normal stylistic coaching: it is operational guidance for deceptive impersonation, which can facilitate fraud or manipulation if reused outside the narrow game setting.

VirusTotal

64/64 vendors flagged this skill as clean.