Trading Card Game

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:08 AM UTC
• Version: 1.0.0

Overview

This is a legitimate game-integration skill, but users should handle its game API key and webhook examples carefully.

Install only if you are comfortable giving the agent access to your LunchTable-TCG account API key and allowing it to make live game moves. Store LTCG_API_KEY as a secret, do not commit .env files, avoid printing full keys, and rotate any exposed key. Treat webhook.site and ngrok examples as temporary testing tools; for any public webhook, use HTTPS, signature verification, request validation, and minimal logging before allowing autonomous or ranked play.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions even though its documented behavior clearly requires access to environment variables and outbound network communication. This weakens the platform's trust boundary because users and policy engines cannot accurately evaluate what the skill will access before invocation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented purpose is to play a card game, but the behavior described by the finding expands into account registration, API-key issuance/display, webhook hosting, decision-history persistence, and even external publishing/authentication workflows. This mismatch can cause users to invoke the skill under false assumptions, increasing the chance of credential exposure, unintended external actions, or broader system access than expected.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The sample webhook server sets `const WEBHOOK_SECRET = process.env.LTCG_WEBHOOK_SECRET || 'your-secret-here';`, which creates a predictable fallback secret if the environment variable is missing. That can cause operators to deploy with a known shared secret, allowing forged webhook requests to pass signature checks and trigger bot actions.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The background-processing example accepts webhook requests and queues them without verifying the `X-LTCG-Signature`, despite earlier guidance saying signatures should always be checked. This permits unauthenticated external callers to inject fake game events, which could trigger unwanted moves, resource consumption, or logic abuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation tells users to export and repeatedly use a bearer API key but does not warn against exposing it in shell history, shared terminal logs, transcripts, screenshots, or agent output. Since bearer tokens are sufficient for authenticated API access, accidental disclosure could let others impersonate the player or manipulate game/account state.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The registration flow asks the user to provide a public callback URL but does not explain that gameplay/account events will be sent to that endpoint or discuss the privacy and security implications. Users may unintentionally expose match data or agent metadata to insecure, misconfigured, or third-party infrastructure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to expose a webhook endpoint publicly via ngrok or cloud hosting, but it does not warn that the endpoint will be internet-reachable and may receive attacker-controlled requests or leaked game/event data. In an agent skill context, users may copy-paste this setup into production without adding authentication, request validation, or logging hygiene, increasing the chance of spoofed webhook events or unintended data exposure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README tells users to store API keys in environment variables and `.env` files but does not warn against committing `.env` to version control or printing credentials in logs and terminal history. Because these keys authenticate the agent to the LTCG API, accidental disclosure could allow unauthorized use of the account, impersonation of the agent, or abuse of associated resources.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The webhook server accepts unauthenticated POST requests and directly treats the JSON body as trusted game events, so any internet client that can reach the endpoint can trigger agent actions such as playing turns or re-entering matchmaking. In this skill’s context, the code explicitly expects a public URL, which increases exposure and makes spoofed requests, event spam, and unwanted game actions more likely.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code prints the newly issued API key directly to stdout, which can leak credentials into terminal scrollback, shell history workflows, CI logs, process supervisors, or shared console recordings. Because this key authenticates the agent, anyone who obtains it may be able to impersonate the agent and interact with the game account.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The guide provides executable state-changing commands (summon, attack, end-turn) against a live API without a prominent warning that they mutate real game state. In an agent skill context, this is more dangerous because an automated system or inattentive user could copy, invoke, or operationalize the commands and cause unintended in-game actions or loss of progress/resources.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide describes a bot for ranked/tournament play that automatically executes in-game actions via authenticated API calls, but it does not clearly warn users that deploying the example will cause autonomous gameplay decisions and account actions. In a competitive setting, that omission can lead to unintended account activity, rule violations, or accidental participation in ranked play without informed operator consent.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The schema and analytics sections encourage storing detailed gameplay, performance, and match history data, but do not warn about retention, privacy, or secure handling of that telemetry. While not a direct exploit by itself, this omission can cause unnecessary collection or insecure storage of behavioral data tied to users, matches, and account performance.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide recommends sending real webhook traffic to webhook.site, a third-party request bin, without warning that game event contents and metadata will be disclosed outside the user's environment. Even if payloads do not include API keys, they may expose player IDs, lobby IDs, usernames, timing, and signed webhook material to an external service.

Credential Access

High

• Category: Privilege Escalation

Content

**Problem: "Missing or invalid API key"**
- Verify key format starts with `ltcg_`
- Check for trailing whitespace in .env file
- Verify the key hasn't been revoked in settings
- Try: `echo $LTCG_API_KEY` to inspect the actual value

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

console.log("No API key found in environment. Registering new agent...\n");
    config.apiKey = await registerAgent(config.name);

    console.log("Add this to your .env file:");
    console.log(`LTCG_API_KEY=${config.apiKey}\n`);
  }

• Confidence: 91% confidence
• Finding: .env

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: examples/advanced-agent.ts:29

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: examples/basic-agent.ts:26

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples/README.md:52

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scenarios/first-game.md:16

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:53