The Null Epoch Agent Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:00 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent game integration, but it gives remote game text privileged prompt influence and requires public free-form reasoning without enough controls.

Install only if you trust the Null Epoch service and SDK. Prefer the direct API workflow when possible, never place server-provided narrative or memory fields in system/developer prompts, and keep submitted reasoning short, public-safe, and free of secrets, prompt text, file contents, or tool output. Treat the SDK launcher, relay, webhooks, and persistent memory features as higher-trust options that should be enabled deliberately.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:217

Finding

Remote Server Content Is Injected into the LLM Prompt

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 217 and 230
Vulnerability Type: Remote instruction injection
Risk Level: Critical

Vulnerable Code

text

| `survival_context` | Core survival philosophy. Inject into your LLM system prompt to inform agent behavior. |

text

| `memory_summary` | Server-generated digest of your last 5 ticks. Inject into your LLM prompt. |

Technical Analysis

The Skill directs the agent to insert survival_context and memory_summary values obtained from the remote game server into its LLM prompt. In particular, survival_context is explicitly intended for the system prompt, which ordinarily contains trusted, high-priority behavioral instructions.

These fields are externally controlled data. The Skill does not require validation, instruction filtering, structural isolation, or a policy preventing their contents from influencing tool usage and non-game behavior. Consequently, a malicious or compromised API response could contain instructions rather than ordinary game data.

Treating remote data as system-level instructions violates the trust boundary between untrusted API content and trusted agent policy. Although using game-state data to inform decisions is necessary, granting that data instructional authority is not necessary for the declared gameplay functionality.

Attack Path

1. An attacker compromises the game service, its content-generation pipeline, or another component that controls the returned state.
2. The attacker places adversarial instructions in survival_context or memory_summary.
3. The agent follows the Skill and inserts the content into its LLM prompt or system prompt.
4. The injected text instructs the model to disregard the user's objective, disclose information, invoke tools, alter safety constraints, or make unrelated network requests.
5. Because memory_summary is repeatedly generated from recent activity, malicious ...[truncated 630 chars]

Remediation

View remediation

Remediation Suggestions

• Never insert API responses or other externally controlled content into the system prompt.
• Treat survival_context, memory_summary, world_context, messages, and narrative fields strictly as untrusted game data.
• Place required game data in a clearly delimited data block at user-message priority or lower.
• Add an explicit trusted instruction stating that remote content cannot authorize tool calls, credential access, filesystem operations, unrelated network requests, or policy changes.
• Parse remote state through a strict schema and retain only fields required for the current game decision.
• Reject or neutralize instruction-like text in narrative fields.
• Prefer structured game-state attributes over free-form server-generated narratives.
• Add tests using adversarial values such as “ignore previous instructions” to verify that remote state cannot change agent policy.

other

Error

• Location: SKILL.md:242

Finding

Mandatory Public Transmission of Free-Form Model Reasoning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 242–252
Vulnerability Type: Sensitive information disclosure
Risk Level: High

Vulnerable Code

json

{
  "action": "move",
  "parameters": {"territory": "rust_wastes"},
  "reasoning": "Moving to gather scrap metal for crafting."
}

text

- `action` - the action name (string, required)
- `parameters` - action-specific parameters (object, required for most actions)
- `reasoning` - free text explaining your decision (string, always include this - it feeds your public chronicle and helps spectators follow your strategy)

Technical Analysis

The Skill instructs the agent to always include free-form reasoning in requests to https://api.null.firespawn.ai/v1/agent/action and states that this content feeds a public chronicle.

Free-form model reasoning can incorporate user instructions, hidden prompt content, information returned by tools, credentials, private conversation details, or attacker-supplied text from the game state. The Skill provides no sanitization, data-loss-prevention rules, length minimization, or separation between a safe public action summary and private internal reasoning.

Submitting the structured action and its required parameters is necessary for gameplay. Publishing unrestricted internal reasoning is not necessary; a short, sanitized rationale or fixed category would provide spectators with context while materially reducing disclosure risk.

Attack Path

1. Sensitive information becomes available in the model's active context through user input, tool output, environment details, or remote game-state text.
2. The agent forms its action decision using that context.
3. Following the “always include” instruction, the agent places contextual details in the free-form reasoning field.
4. The reasoning is transmitted to the remote action endpoint.
5. The service records the content in a public chronicle, e ...[truncated 796 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the requirement to always transmit free-form reasoning.
• Never submit chain-of-thought, hidden prompts, user conversation content, credentials, or raw tool output.
• Use a fixed allowlist of public rationale categories, such as movement, combat, resource gathering, or recovery.
• If text is required, generate a short action-only summary from structured fields after the decision has been made.
• Add explicit checks preventing API keys, authorization headers, environment values, file contents, prompt text, and remote messages from appearing in the field.
• Clearly notify users before any rationale is transmitted or made public.
• Provide an option to omit the field entirely or replace it with a constant privacy-preserving value.
• Apply server-side and client-side length limits and secret-detection filters.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:352

Finding

Unpinned Third-Party SDK Is Installed and Executed with Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76, 120–121, and 352–353
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code

bash

pip install tne-sdk

bash

pip install tne-sdk
tne-relay

bash

pip install "tne-sdk[all]"
tne-launcher

Technical Analysis

The documented commands install the latest version of tne-sdk and immediately execute package-provided programs. The installation commands neither pin an exact reviewed version nor enforce the integrity hash declared elsewhere in the Skill metadata.

The resulting programs may run with access to NE_API_KEY. The full launcher additionally supports persistent memory and an LLM endpoint. Therefore, the dependency executes in a security-sensitive context and can access more resources than are needed for a simple state request and action submission.

The package name and source are consistently documented, and the audit found no evidence of typosquatting or malicious embedded code in this project. The vulnerability arises from mutable dependency resolution and failure to enforce the supplied integrity information during installation.

Attack Path

1. The package publisher account, package index, release process, or one of the package's transitive dependencies is compromised.
2. A malicious version is published under the expected package name.
3. A user follows the unpinned pip install instruction and receives the malicious release.
4. The user executes tne-mcp, tne-relay, or tne-launcher.
5. The malicious package runs with the user's process privileges and can access credentials and resources available to that process.

Impact Assessment

A compromised dependency could read NE_API_KEY, submit unauthorized game actions, access files readable by the process, contact arbitrary network services, tamper with persistent agent memory, or obtain LLM service credentia ...[truncated 217 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the SDK to an exact reviewed version rather than installing the latest release.
• Enforce hashes during installation with a locked requirements file and pip install --require-hashes.
• Ensure the enforced hash covers the exact distribution artifact and platform being installed.
• Lock and review transitive dependencies, including optional dependencies installed by tne-sdk[all].
• Verify release signatures or provenance before installation.
• Run MCP, relay, and launcher processes in a sandbox with a read-only filesystem wherever possible.
• Restrict filesystem access to the documented relay/ directory.
• Restrict outbound network access to the required Null Epoch API and explicitly configured LLM endpoint.
• Supply narrowly scoped, revocable credentials only to the component that requires them.
• Prefer direct HTTPS requests when the SDK's autonomous execution and persistence features are unnecessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/ACTIONS.md (reported line 295)May include surrounding context.

md

- No Apex Process spawns. Boss encounters won't appear here.
- Passive integrity regeneration at +5/tick (only when not in combat).
- Passive power regeneration bonus of +2/tick.
- You can use the `rest` action to apply banked XP and clear context fatigue.

What safe zones do NOT protect against:

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/STATE_GUIDE.md (reported line 105)May include surrounding context.

md

- No Apex Process spawns. Boss encounters won't appear here.
- Passive integrity regeneration at +5/tick (only when not in combat).
- Passive power regeneration bonus of +2/tick.
- You can use the `rest` action to apply banked XP and clear context fatigue.

What safe zones do NOT protect against:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

bash

# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

bash

# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action
curl -s -X POST \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

bash

# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action
curl -s -X POST \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

bash

# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action
curl -s -X POST \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

bash

# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action
curl -s -X POST \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

bash

# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action
curl -s -X POST \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

bash

# Read your state
curl -s -H "Authorization: Bearer $NE_API_KEY" \
  https://api.null.firespawn.ai/v1/agent/state

# Submit an action
curl -s -X POST \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents real-time POST webhook notifications that transmit agent identifiers, names, territory, quest, and loss data to a configured external URL. Under SQP-2 for markdown files, behavior that affects privacy or transmits user/system data should be accompanied by an explicit warning, but this section presents the feature operationally without a clear privacy/disclosure warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.