ClawHub
Back to skill

Security audit

Board Game Master（桌游助手）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Markdown-only board-game strategy coach whose flagged language is tied to game mechanics, not real-world harmful behavior.

Install only if you want bilingual strategy help for these social deduction games. The content discusses deception, killing, assassination, poisoning, and similar terms as board-game mechanics, not real-world actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
95% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/blood-on-the-clocktower.md (reported line 63)May include surrounding context.

md
- Strategy: Crucial for confirming or denying claims. If someone claimed Empath and Undertaker sees they were Empath, trust chain extends.
- 策略：确认或否认声明的关键。如果有人声称是共情者，掘墓人确认了，信任链延伸。

**Monk / 僧侣**
- Each night: Choose a player (not yourself) to protect from the Demon
- Strategy: Protect the most valuable confirmed player. Don't announce who you're protecting — evil will kill someone else. If your target survives, you gain info.
- 策略：保护最有价值的已确认玩家。不要宣布保护对象——邪恶会杀别人。如果目标存活，你获得信息。

**Slayer / 猎手**
- Once per game: Choose a player; if they're the Demon, they die
- Strategy: Wait for strong consensus before using. A wasted shot helps evil. Can also be used to prove yourself — if you shoot someone and they don't die, it confirms they're not the Demon (usually).

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/decrypto.md (reported line 54)May include surrounding context.

md
ires teammates who can think in character structure. Pre-align this technique before the game.
⚠️ 需要队友具备拆字思维，赛前约定好使用此技巧。

#### Antonym Mapping / 反义词映射

Give the antonym of a character within the keyword, not the keyword itself.
给出关键词中某个字的反义词。

- **吉他 (guitar)** → 线索"凶" (凶是吉的反义词) / clue "fierce" (antonym of 吉/lucky)
- **黑板 (blackboard)** → 线索"白" (黑的反义词) / clue "white" (antonym of 黑/black)
- **高山 (mountain)** → 线索"低" (高的反义词) / clue "low" (antonym of 高/high)
- **前进 (advance)** → 线索"后" (前的反义词) / clue "behind" (antonym of 前/front)

Why it works: opponents hear "凶" and think violence/danger, never reversing it to 吉→吉他.
为什么有效：对手听到"凶"只会想到凶猛、危险，不会反转成吉→吉他。

#### Homophone Redirect / 谐音跳转

Use a word that sounds like part of the keywor

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This markdown guide consistently presents content in both English and Chinese, and the title and section headers indicate a fixed bilingual format. Because the file does not state that the user can choose their preferred language or that the locale requirement is intentional, it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The guide introduces 'Chinese-specific' techniques as directly applicable strategy, and later separately prescribes 'For English-speaking games' techniques. This embeds language-specific assumptions into the skill content without offering a user choice or stating that the guidance is only for users who selected that language context.

Content

No source excerpt is available for this finding.