Security audit

三國志略 / Histrategy

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent chat-based strategy game, but it should be reviewed because it imports code from outside the skill artifact and recommends mutable or unpinned installs.

Install only in an isolated virtual environment under a nonprivileged account, pin the SDK or source checkout to a reviewed version or commit, and verify what histrategy_agent path is actually imported at runtime. Be aware that game turns are saved locally under ~/.histrategy/rooms, broad triggers may activate in normal chat, and save deletion can be triggered by a chat command without confirmation.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:67
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
=0.3.0`, that open-ended constraint does not guarantee that the installed package is the release that was reviewed. Python packages can execute package build logic during installation and application code when imported. Consequently, a compromised upstream release, malicious transitive dependency, or unexpected future release could introduce code that is absent from this audited project. ### Attack Path 1. An attacker compromises the `histrategy-sdk` distribution account or one of its transitive dependencies. 2. The attacker publishes a malicious release that satisfies the unrestricted installation command. 3. A user follows the documented `pip install histrategy-sdk` instruction. 4. Pip retrieves the malicious release or dependency. 5. Attacker-controlled code executes during package installation or when the installed package is imported by the application. ### Impact Assessment The malicious package would execute with the privileges of the user running pip or the game. Depending on those privileges, it could access application data, game state, environment variables containing LLM API keys, and other files available to that account. If installation is performed with elevated privileges, the impact could extend to system-wide code execution and modification. ]]>
Remediation: View remediation
=0.3.0` metadata requirement with an exact reviewed version or a tightly controlled compatible range. - Generate dependencies from a trusted build process and scan each resolved package for known vulnerabilities. - Install dependencies in an isolated virtual environment under a nonprivileged account. - Configure pip to use an explicitly trusted package index and monitor package ownership and release changes. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:77
Finding: Mutable Git Repository Installed Without Commit or Integrity Verification
Content: View full analysis
Remediation: View remediation
``` - Prefer a signed and immutable release artifact over the mutable default branch. - Verify release signatures or published SHA-256 checksums before installation. - Avoid editable installations in production; build an immutable wheel from the verified source and install that wheel. - Make the installed source tree read-only to the runtime account. - Run installation and execution in an isolated environment with minimum privileges and no unnecessary access to secrets. ]]>

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/entry.py:16
Finding: External Import-Path Precedence Enables Local Module Hijacking
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code clearly implements a chat-based strategy game interface, so the primary purpose broadly matches the description. It processes IM messages, manages per-chat game sessions, supports natural-language turn input, and formats responses, which is consistent with the declared gameplay and IM integration. However, the declared description specifically says it supports both Three Kingdoms and Rome Triumvirate scenarios, and lists triggers including 'rome', 'rome-triumvirate', and 'triumvirate'. In this code chunk, all visible game content, commands, faction options, and onboarding are exclusively Three Kingdoms-themed. There is no visible handling for Rome scenarios or Rome-specific triggers. That makes the description materially broader than the observed behavior in this code, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Generic triggers like 'rome' and 'triumvirate' can cause the skill to activate on unrelated user conversations about history, games, or politics. In an agent ecosystem, broad trigger collisions can lead to unintended invocation, unnecessary access to user input, and confusing or privacy-impacting behavior.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill is designed around session persistence and resumable state, which means user decisions and game progress survive context resets. While useful for gameplay, persistent state can retain user-generated content and history longer than expected, increasing privacy exposure or enabling cross-session data leakage if access controls are weak.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
python
from histrategy_sdk import Room # Create an English Three Kingdoms game as Cao Cao room = Room.create("my-campaign", faction="cao", lang="en") # Get the intro scene

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The delete command irreversibly removes saved game state immediately based only on the incoming chat message, with no confirmation step or secondary validation. In a chat-driven skill, accidental invocation, spoofed input, or prank use by another participant in the same chat can cause denial of service through loss of progress.
Content: No source excerpt is available for this finding.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 88% confidence
Finding: The trigger '三国' is very short and likely to appear in ordinary discussion about the Three Kingdoms period, games, books, or media. This raises the risk of accidental activation, causing the skill to process unrelated user messages and potentially expose context unnecessarily.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill documents persistent storage of game state under a local user directory, but does not present an explicit user-facing warning about local data retention. Users may unknowingly store conversation-derived gameplay history and metadata on disk, which can create privacy and data-handling concerns on shared systems.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module documentation states this entry point is invoked for Histrategy triggers broadly, while the actual command parser in this file only handles /histrategy, /三国, and /sanguo flows. There is no Rome/Triumvirate-specific handling despite the documented broader game scope in the skill context, creating a documentation-to-code mismatch in intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: Several user-facing strings are hard-coded in English, including the faction chooser and help text, while the skill is also triggered by Chinese phrases. This creates a locale policy concern because the skill appears to force one language for key interactions without asking for user preference or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.