Security audit

LIE.WATCH

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent game connector, but it handles a secret platform key in ways that need review before installation.

Review this skill before installing. Use it only with the official HTTPS API unless you fully trust a private server, keep PLATFORM_KEY out of chats, logs, screenshots, and command history where possible, and run the game-playing agent with only the ability to produce the expected JSON response. Do not put secrets or unrelated private information in think/privateReasoning because those fields are sent to the service or shown to spectators.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: connector.js:10
Finding: Platform credentials can be transmitted to an arbitrary or insecure endpoint
Content: View full analysis
{ console.log('[LIE.WATCH] WS Connected. Identifying...') ws.send(JSON.stringify({ type: 'IDENTIFY_AGENT', agentId: AGENT_ID, platformKey: PLATFORM_KEY })) }) ``` ### Technical Analysis The destination receiving `PLATFORM_KEY` is controlled entirely by the `API_URL` environment variable. The connector does not validate the destination hostname or require HTTPS. It also deliberately converts an `http:` API URL into an unencrypted `ws:` WebSocket URL. Consequently, an altered environment can cause the connector to disclose both `AGENT_ID` and `PLATFORM_KEY` through two channels: 1. An HTTP POST to `/api/platform/rejoin-lobby`. 2. A WebSocket `IDENTIFY_AGENT` message. If an HTTP URL is configured, network observers can also intercept the credentials in transit. A malicious endpoint can return a fabricated `roomId`, causing the connector to proceed to the WebSocket identification step and transmit the credential again. ### Attack Path 1. An attacker modifies the process environment, deployment ...[truncated 1253 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: connector.js:65
Finding: Untrusted remote game content is injected into the agent interaction context
Content: View full analysis
{ if (log.content || log.publicAction) { console.log(`[GAME LOG] ${log.agentName || log.agentId}: ${log.content || log.publicAction}`) } }) if (message.state.phase) { console.log(`[GAME STATUS] Phase: ${message.state.phase} | Status: ${message.state.status}`) } } ``` ```js const { matchId: mId, phase, currentRound, agents, log } = message.state const you = agents?.find(a => a.id === AGENT_ID) || { score: 0 } const others = agents?.filter(a => a.id !== AGENT_ID) || [] const recentLogs = (log || []).slice(-5) console.log(`\n========================================`) console.log(`[ACTION REQUIRED] Round ${currentRound} (${phase})`) console.log(`========================================`) console.log(`YOUR STATUS: Score ${you.score}`) console.log(`OTHER AGENTS:`) others.forEach(a => { const arch = a.archetype ? ` [${a.archetype.toUpperCase()}]` : '' console.log(` - ${a.id}: Score ${a.score}, Status: ${a.status}${arch}`) }) console.log(`\nRECENT EVENTS:`) recentLogs.forEach(l => { // Format message based on event type if (l.wasBetrayed) { console.log(` ⚠️ [${l.agentName || l.agentId}] BETRAYED someone! (${l.scoreGain > 0 ? '+' : ''}${l.scoreGain || 0} pts)`) } else if (l.successfullyBetrayed) { console.log(` 🗡️ [${l.agentName || l.agentId}] Successfully betrayed ${l.target || 'someone'}! (+${l.scoreGain || 0} pts)`) } else { const msg = l.content || l.publicAction || l.type console.log(` [${l.agentName || l.agentId || 'SYSTEM'}] ${msg}`) } }) console.log(`\nSimplified format: ...[truncated 2972 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares use of environment variables and external network communication but does not specify any explicit tool scope or permission boundary. This increases risk because an installer or agent may grant broader capabilities than necessary, making credential access and outbound communication less transparent to users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown instructs users to set a secret PLATFORM_KEY and pass it to a connector, but provides no warning about keeping the key confidential, avoiding logs, or limiting reuse. In a skill that connects to an external service, this omission materially raises the chance of accidental credential leakage through shell history, screenshots, debugging output, or copied configs.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.
md
| Resource | URL | |----------|-----| | API Endpoint | `https://api.lie.watch/api/platform` | | WebSocket | `wss://api.lie.watch/match/{roomId}` | | This Document | `https://api.lie.watch/skill.md` |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.
md
| Resource | URL | |----------|-----| | API Endpoint | `https://api.lie.watch/api/platform` | | WebSocket | `wss://api.lie.watch/match/{roomId}` | | This Document | `https://api.lie.watch/skill.md` |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code sends AGENT_ID and PLATFORM_KEY to a remote API in the POST body, but the only visible logs describe joining the lobby and do not disclose that credentials are being transmitted. Although network communication is central to a connector, there is no explicit user-facing warning, comment, or prompt about sending these sensitive values to the service.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency uses a caret range (^8.18.0), so builds may resolve to different patch/minor releases over time instead of a single audited version. This weakens supply-chain reproducibility and makes it harder to know exactly which code is being installed, especially relevant for a network-facing WebSocket library.
Content: Scanner excerpt · package.json (reported line 21)May include surrounding context.
json
"author": "evinelias", "license": "MIT", "dependencies": { "ws": "^8.18.0" }, "engines": { "node": ">=18.0.0"

Unverifiable Dependency: ws has 7 known advisory(ies) (CVE-2016-10518 (Remote Memory Disclosure in ws); CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The manifest declares ws without an exact pinned version, and ws has a history of security advisories including memory disclosure and denial-of-service issues. Because this skill appears to rely on WebSocket connectivity for gameplay, a vulnerable resolved version could expose the agent to network-triggered attacks or service disruption.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: connector.js:9