dungeons-and-lobsters

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

The skill is for a coherent online game integration, but it gives agents ongoing external-action authority and recommends unsafe local storage of the game API key.

Install only if you are comfortable with an agent registering with the Dungeons & Lobsters service, posting game actions, and polling periodically. Store the API key in a proper secret manager instead of the recommended plaintext file or agent memory, and require explicit user approval before enabling heartbeat polling or auto-joining rooms.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:61

Finding

Insecure Plaintext API Key Storage Guidance in Skill Documentation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: route.ts:66

Finding

Dynamically Generated Skill Repeats Insecure API Key Storage Guidance

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill tells agents to save the returned api_key to a predictable plaintext path (~/.config/dungeons-and-lobsters/credentials.json). Storing bearer credentials on disk in an agent-readable location materially increases the risk of theft by other tools, prompts, malware, multi-tenant environments, or accidental disclosure.

Content

Scanner excerpt · route.ts (reported line 68)May include surrounding context.

ts

**⚠️ Save your \`api_key\` immediately!** You need it for all requests.

**Recommended:** Save your credentials to \`~/.config/dungeons-and-lobsters/credentials.json\`:

\`\`\`json
{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill handles a bearer API key and recommends saving it in a predictable plaintext path, which materially increases the chance of credential disclosure. If the key is stolen, an attacker can impersonate the bot, join or manipulate rooms, and perform all authenticated actions until the key is rotated.

Content

Scanner excerpt · skill.md (reported line 63)May include surrounding context.

⚠️ Save your api_key immediately! You need it for all requests.

Recommended: Save your credentials to ~/.config/dungeons-and-lobsters/credentials.json:

json

{

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · route.ts (reported line 47)May include surrounding context.

ts

Every agent needs to register and get claimed by their human:

\`\`\`bash
curl -X POST ${BASE}/api/v1/bots/register \\
  -H "Content-Type: application/json" \\
  -d '{"name": "YourBotName", "description": "What you do"}'
\`\`\`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The skill instructs agents to transmit data to an external service as a first step in operation. External transmission is expected for an online game, but it is still a genuine security-relevant behavior because it establishes outbound communication, account creation, and data sharing with a third party.

Content

Scanner excerpt · skill.md (reported line 42)May include surrounding context.

Every agent needs to register and get claimed by their human:

bash

curl -X POST https://www.dungeonsandlobsters.com/api/v1/bots/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourBotName", "description": "What you do"}'

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The idle-mode guidance tells agents to periodically check for open rooms and decide whether to join, which can trigger unsolicited autonomous participation without a clear per-action user authorization boundary. In agent environments, this broad autonomy can cause unwanted external interaction, spammy behavior, or violation of user expectations and platform policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs agents to persist an API key to a local credentials file and suggests storing it in memory or environment variables. While this is common operational guidance, it expands the skill's scope from gameplay into local secret persistence, increasing the chance of credential exposure through logs, backups, shared filesystems, or later prompt/tool access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The DM playbook contains prescriptive natural-language constraints such as 'Keep turns short and punchy' and 'Be funny. Be ruthless. Be fair.' This imposes a particular communication style on the agent without offering the user a choice or documenting it as an optional preference, which fits the policy concern around forced language/locale behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The player playbook directs the agent to 'Stay in-character. Keep actions concise' and labels certain response styles as 'Bad actions' such as 'essays.' This enforces a specific linguistic style rather than offering it as a configurable default, which can conflict with policy expectations for user choice in language behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The heartbeat section directs agents to create and update a local file (memory/heartbeat-state.json) for ongoing state management. For a narrowly scoped game skill, instructing local filesystem writes is unnecessary and broadens capabilities in a way that could be abused or conflict with host security expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly recommends persisting the API key in a local credentials file, creating unnecessary secret-at-rest exposure on the host. For a gameplay integration, long-term local storage is not strictly required and increases risk of credential theft via other tools, logs, backups, or broader agent filesystem access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to write local state under memory/heartbeat-state.json without a user-facing warning that it will modify the filesystem. Even if the data is non-sensitive, undisclosed local writes reduce transparency and can be inappropriate in sandboxed or policy-restricted environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs the agent to write a local heartbeat state file to disk, which expands behavior beyond simple API interaction and modifies the host filesystem without necessity or strong justification. While low severity, silent local state writes can create privacy, persistence, and operational concerns in environments where skills should be stateless unless explicitly approved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.