qq群聊ai dnd dm

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:55 AM UTC
• Version: 1.0.1

Overview

This skill is a Chinese-language tabletop RPG helper that uses small local scripts for dice rolls and campaign state, with no evidence of network access, credential use, or deceptive behavior.

Install only if you want a Chinese-language, harsh Darkest Dungeon-style RPG mode. It will use local Python scripts to roll dice and store campaign state such as player HP, stress, status, inventory, and logs in a local JSON file; resetting the campaign overwrites that saved state.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个完整的、特定风格的跑团 DM 能力，核心应包括叙事主持、状态管理（如压力/火把）、战斗判定机制以及与用户互动推进冒险。提供的代码却只是一个独立的命令行掷骰脚本：解析骰子表达式、生成随机数并汇总结果。虽然掷骰可以作为跑团的辅助实现细节之一，但当前代码只覆盖了非常小的一部分支持功能，完全不足以体现所声明的主要用途。因此描述与实际行为存在明显且实质性的不匹配。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill instructs the agent to use local scripts that imply file read/write and persistent state access, but it declares no tool scope or permissions boundary. That creates an authorization gap where a seemingly narrative DM skill can access or modify files without explicit disclosure or restriction, increasing the chance of unintended data access or state tampering.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger conditions are broad and loosely defined, so the skill may activate in conversations that merely mention dark fantasy, Cthulhu, or exploration themes. Because the skill also instructs memory access and persistent state changes, overbroad activation increases the chance of those capabilities being invoked outside a clearly intended context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill requires updating persistent player state through memory.py without warning users that their data will be stored or modified. Hidden persistence can surprise users, create privacy concerns, and cause integrity issues if character data is changed or retained without informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The workflow explicitly directs execution of local Python scripts and persistent mutation of player records, even though the skill is framed as a tabletop narrator persona. This expands the skill from harmless roleplay into code execution and state-changing behavior, which can expose local resources, enable unintended file operations, and create hidden side effects for users.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow mandates reading saved state from memory at each reply without informing users that previously stored data will be accessed. Undisclosed retrieval of persisted state can leak prior session information into a new interaction and violates user expectations about privacy and session boundaries.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The script's natural-language messages, defaults, and CLI help are written in Chinese, and there is no indication that the skill is intentionally region-specific or that users can opt into another language. This can violate language/locale policy when a skill imposes a language without user choice.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The reset command replaces the existing campaign state by writing a new default object to the persistent JSON file. Although it prints a message after completion, there is no pre-action confirmation, warning comment/docstring, or other disclosure that existing saved data will be lost.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: Line L18 states that when HP drops to 0, a character will absolutely not die immediately and instead enters Death's Door. Later, L44 says reaching stress 200 causes direct death without entering Death's Door, which contradicts the earlier absolute wording about death handling and can mislead the agent about intended game logic.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The code's natural-language comments and user-facing output strings are exclusively in Chinese, including usage and error messages. This imposes a specific language on all users without opt-in or any documented justification that the skill is intended only for a Chinese-language audience.