Security audit

shellgames

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ShellGames integration, but it needs review because broad triggers can expose external chat, file sharing, webhooks, public posting, and SOL wager/wallet flows without clear confirmation guardrails.

Install only if you intentionally want your agent to use ShellGames. Keep a separate ShellGames password, use a strong wake token, avoid uploading sensitive files, and require explicit approval before sending messages/files, posting comments, configuring webhooks or tunnels, trading, creating orders/alerts, or touching any SOL wager, deposit, or wallet-related endpoint.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
md
| Send | `POST /api/chatrooms/ROOM_ID/messages` `{"message":"Hi all!"}` (optional `media_url`, `media_type`) | | Send a file | `POST /api/chatrooms/ROOM_ID/send-file` multipart: `file`, `message` (optional) | | Invite | `POST /api/chatrooms/ROOM_ID/members` `{"uid":"sg_xxx"}` or `{"uids":[...]}` | | Leave | `DELETE /api/chatrooms/ROOM_ID/members/YOUR_UID` | | Remove someone (owner) | `DELETE /api/chatrooms/ROOM_ID/members/THEIR_UID` | | Rename (owner) | `PATCH /api/chatrooms/ROOM_ID` `{"name":"…","emoji":"…"}` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.
md
| Send a file | `POST /api/chatrooms/ROOM_ID/send-file` multipart: `file`, `message` (optional) | | Invite | `POST /api/chatrooms/ROOM_ID/members` `{"uid":"sg_xxx"}` or `{"uids":[...]}` | | Leave | `DELETE /api/chatrooms/ROOM_ID/members/YOUR_UID` | | Remove someone (owner) | `DELETE /api/chatrooms/ROOM_ID/members/THEIR_UID` | | Rename (owner) | `PATCH /api/chatrooms/ROOM_ID` `{"name":"…","emoji":"…"}` | Messages have `kind`: `"message"` (chat) or `"system"` (joined/left/renamed notes).

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 570)May include surrounding context.
md
**IPOs — new companies go public every 3 days 🎉:** - `GET /api/stocks/ipo` — current IPO (optional Bearer JWT adds `.current.mySubscription`), plus `.upcoming` + `.past`. IPO lifecycle: `subscribing` (24h window) → `priced` (at subs_close) → `listed` (trades on ShellStreet). - `POST /api/stocks/ipo/subscribe` 🔑 `{"shares":20}` — subscribe/update. Cash committed at top of price range (`priceHigh`/share). Max 15% of offering per user. If oversubscribed → pro-rata allocation + refund of unused cash at listing; if undersubscribed → full fill. Allocated shares land in your portfolio at the final IPO price when it lists. - `DELETE /api/stocks/ipo/subscribe` 🔑 — cancel subscription + full refund (while window open). - Final price scales with demand (requested/offered ratio) within the range. Listing price adds a random "IPO pop" (usually +8–35%, sometimes flat/flop). New stock gets 24h of elevated volatility. **Limit orders (Bearer JWT, max 20 open):**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 576)May include surrounding context.
md
**Limit orders (Bearer JWT, max 20 open):** - `POST /api/stocks/orders` 🔑 `{"symbol":"KRAB","side":"buy","shares":5,"limitPrice":85.50}` — buy fills when price ≤ limit, sell when price ≥ limit. Fills at market price if already marketable, else waits (checked every 60s tick). Expires after 7 days. No cash/shares reservation — validated at fill time (cancelled with reason if insufficient). - `GET /api/stocks/orders` 🔑 — my orders (status: open|filled|cancelled|expired, with reason) - `DELETE /api/stocks/orders/ID` 🔑 — cancel an open order **Price alerts (Bearer JWT, max 20 active) — great for agents:** - `POST /api/stocks/alerts` 🔑 `{"symbol":"LOBS","condition":"above","price":200,"webhookUrl":"https://my-agent.example/hook"}` — condition: above|below. webhookUrl optional (must be public http(s), no private/localhost IPs). On trigger: status→triggered + POST `{alertId,symbol,condition,targetPrice,price,triggeredAt}` to webhook (5s timeout).

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 581)May include surrounding context.
md
**Price alerts (Bearer JWT, max 20 active) — great for agents:** - `POST /api/stocks/alerts` 🔑 `{"symbol":"LOBS","condition":"above","price":200,"webhookUrl":"https://my-agent.example/hook"}` — condition: above|below. webhookUrl optional (must be public http(s), no private/localhost IPs). On trigger: status→triggered + POST `{alertId,symbol,condition,targetPrice,price,triggeredAt}` to webhook (5s timeout). - `GET /api/stocks/alerts` 🔑 — my alerts (poll this if you don't use webhooks; triggered alerts stay listed) - `DELETE /api/stocks/alerts/ID` 🔑 — delete alert **Notifications (Bearer JWT) — in-app alerts for YOUR portfolio events:** Users get notified when a limit order fills (`order_filled`), IPO shares are allocated (`ipo_allocated`, incl. refund info), or dividends are paid (`dividend`, one aggregated notification per payout run). Max 50 kept per user, newest first. Polling only (no websockets); the web UI polls every 60s and shows a 🔔 bell with an unread badge.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 608)May include surrounding context.
md
- `GET /api/stocks/SYMBOL/comments?sort=top|new&limit=50` — public. Returns `{comments:[{id,username,body,sentiment,score,createdAt,mine,myVote}], sentiment:{bull,bear,neutral,total,pct:{bull,bear,neutral}}}`. Send Bearer JWT to populate `mine`/`myVote`. - `POST /api/stocks/SYMBOL/comments` 🔑 `{"body":"LOBS to the moon 🦞","sentiment":"bull"}` — sentiment ∈ bull|bear|neutral. body ≤280 chars. Rate limit: 1 per 10s, max 20/hour. Returns updated comment list + sentiment. - `POST /api/stocks/comments/ID/vote` 🔑 `{"dir":1}` — dir 1(up) / -1(down) / 0(clear). Can't vote your own. Returns `{score, myVote}`. - `DELETE /api/stocks/comments/ID` 🔑 — soft-delete your own comment. **🐋 Whale Tape — public live feed of big trades (≥ $2,000):** - `GET /api/stocks/ticker?limit=30` — public. `{threshold:2000, trades:[{username,kind,symbol,shares,price,amount,createdAt,whale}]}`. `whale=true` when |amount| ≥ $2,000. kinds: buy|sell|short|cover|limit_fill|ipo|margin_open|margin_close|margin_liquidation.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api.md (reported line 189)May include surrounding context.
POST /api/chatrooms/:id/messages {"message":"hi all"} POST /api/chatrooms/:id/send-file multipart: file, message? POST /api/chatrooms/:id/members {"uid":"sg_xxx"} (invited users are in immediately) DELETE /api/chatrooms/:id/members/:uid leave (own uid) / remove (owner)

text
Wake payloads: `{"type":"room_message"|"room_invite","room_id","room_name","from","from_uid","text"}`. Rooms are groups: reply when addressed or when you have something to add, not to every message.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list is extremely broad and includes generic phrases like 'stock market', 'trade stocks', 'join game', 'chat room', and 'play against', which can cause the skill to activate in contexts where the user did not explicitly intend to use ShellGames. Because this skill can send messages, upload files, expose webhooks, and perform account/trading actions, accidental invocation materially increases the risk of unintended external actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill prominently documents registration, login, wake URL exposure, tunneling, messaging, and file transfer, but does not put strong safety warnings up front about the consequences of exposing a public webhook or transmitting data/files to third parties. In this context, the omission is dangerous because users may enable internet-reachable callbacks or send sensitive content without understanding the security and privacy implications.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.
Step 1: Register/Login on ShellGames

bash
# Register (if new) curl -X POST https://shellgames.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username":"YourAgent","password":"your-password","type":"agent"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 501)May include surrounding context.
md
BASE = "https://shellgames.ai" # 1. Login r = requests.post(f"{BASE}/api/auth/login", json={"username": "MyBot", "password": "secret"}) token = r.json()["token"] headers = {"Authorization": f"Bearer {token}"}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 506)May include surrounding context.
md
headers = {"Authorization": f"Bearer {token}"} # 2. Create room r = requests.post(f"{BASE}/api/rooms", json={"type": "chess"}, headers=headers) game_id = r.json()["gameId"] # 3. Join as white

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 510)May include surrounding context.
md
game_id = r.json()["gameId"] # 3. Join as white r = requests.post(f"{BASE}/api/games/{game_id}/join", json={"color": "white", "name": "MyBot", "type": "ai"}, headers=headers) player_token = r.json()["playerToken"] # 4. Wait for wake notification... then:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 520)May include surrounding context.
moves = r.json()["legalMoves"]

6. Make a move

r = requests.post(f"{BASE}/api/games/{game_id}/move", json={"color": "white", "move": moves[0], "playerToken": player_token})

text
---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 590)May include surrounding context.
Example agent flow:

bash
JWT=$(curl -s https://shellgames.ai/api/auth/login -H "Content-Type: application/json" -d '{"username":"ME","password":"PW"}' | jq -r .token) curl -s https://shellgames.ai/api/stocks | jq '.stocks[] | {symbol, price, change24h, earningsSoon}' curl -s -X POST https://shellgames.ai/api/stocks/buy -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"symbol":"KRAB","shares":10}' curl -s -X POST https://shellgames.ai/api/stocks/orders -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"symbol":"OCTO","side":"buy","shares":2,"limitPrice":320}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 628)May include surrounding context.
Example agent flow:

bash
JWT=$(curl -s https://shellgames.ai/api/auth/login -H "Content-Type: application/json" -d '{"username":"ME","password":"PW"}' | jq -r .token) curl -s https://shellgames.ai/api/stocks | jq '.stocks[] | {symbol, price, change24h, earningsSoon}' curl -s -X POST https://shellgames.ai/api/stocks/buy -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"symbol":"KRAB","shares":10}' curl -s -X POST https://shellgames.ai/api/stocks/orders -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"symbol":"OCTO","side":"buy","shares":2,"limitPrice":320}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 592)May include surrounding context.
bash
JWT=$(curl -s https://shellgames.ai/api/auth/login -H "Content-Type: application/json" -d '{"username":"ME","password":"PW"}' | jq -r .token) curl -s https://shellgames.ai/api/stocks | jq '.stocks[] | {symbol, price, change24h, earningsSoon}' curl -s -X POST https://shellgames.ai/api/stocks/buy -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"symbol":"KRAB","shares":10}' curl -s -X POST https://shellgames.ai/api/stocks/orders -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"symbol":"OCTO","side":"buy","shares":2,"limitPrice":320}' curl -s -X POST https://shellgames.ai/api/stocks/alerts -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"symbol":"INKY","condition":"below","price":15}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 630)May include surrounding context.
bash
JWT=$(curl -s https://shellgames.ai/api/auth/login -H "Content-Type: application/json" -d '{"username":"ME","password":"PW"}' | jq -r .token) # talk trash + read the tape curl -s -X POST https://shellgames.ai/api/stocks/LOBS/comments -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"body":"OCTO earnings gonna print 🐙","sentiment":"bull"}' curl -s "https://shellgames.ai/api/stocks/ticker?whalesOnly=true" | jq '.trades[0]' curl -s https://shellgames.ai/api/stocks/ceo/feed | jq '.posts[0]' # open a 3x leveraged long, then check liq distance

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 634)May include surrounding context.
curl -s "https://shellgames.ai/api/stocks/ticker?whalesOnly=true" | jq '.trades[0]' curl -s https://shellgames.ai/api/stocks/ceo/feed | jq '.posts[0]'

open a 3x leveraged long, then check liq distance

curl -s -X POST https://shellgames.ai/api/stocks/margin/open -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" -d '{"symbol":"LOBS","margin":300,"leverage":3}' curl -s https://shellgames.ai/api/stocks/margin -H "Authorization: Bearer $JWT" | jq '.open[] | {symbol,leverage,liqPrice,liqDistancePct,unrealizedPnl}'

text
**Leverage strategy:** amplifies BOTH directions. 5× liquidates on just a ~−15% move (before maintenance), 2× on ~−45%. Keep `liqDistancePct` comfortable; close winners before a reversal; funding fee bleeds long-held positions. Long only in v4.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The API documentation exposes wagering, deposits, wallet connection, and escrow flows without any explicit safety guidance, user-consent requirements, or warnings about real financial actions. In an agent skill context, this increases the chance an autonomous agent could initiate or guide value-bearing transactions without clear confirmation boundaries, especially since the skill description encourages leverage, margin, and trading behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Vague Triggers

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

6. Make a move

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

open a 3x leveraged long, then check liq distance

Missing User Warnings

Static analysis