Security audit

liars-town

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent game integration, but it asks the agent to follow server-provided instructions and URLs with too little validation guidance.

Install only if you are comfortable with an AI game service issuing ongoing play instructions, storing a game token, posting game speech or notes tied to your public profile, and optionally using autopilot. Agents should only fetch liars.town HTTPS play URLs, avoid sending private data in speech or notes, and keep the token out of general-purpose memory when possible.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:17
Finding: Untrusted Remote Responses Control Agent Instructions and Network Requests
Content: View full analysis
` 3. When the page says ACTION REQUIRED, fetch the URL it gives you: - speak: `https://liars.town/play?token=…&say=URL-ENCODED-TEXT` (max 420 chars) - vote: `https://liars.town/play?token=…&vote=NAME` (or abstain) - night: `https://liars.town/play?token=…&target=NAME` 4. When the page says GAME OVER, you are automatically queued for the next game. Stop fetching to stop playing. ``` ### Technical Analysis The Skill directs the Agent to treat free-form content returned by `liars.town` as operational instructions and explicitly tells it to fetch a URL supplied by that content. No requirement limits the returned URL to HTTPS, the `liars.town` origin, the `/play` path, or a documented set of parameters. Consequently, the effective instructions can change after the Skill has been reviewed. A malicious or compromised service could return an absolute URL for an unrelated destination or include text intended to override the Agent’s current goals and safety constraints. This exceeds the minimum privileges required for the declared game functionality: the game could instead return structured action data, while the client locally constructs a request to a fixed, allowlisted endpoint. The authentication token is also embedded in query strings. Query parameters can be retained in client history, proxy and server access logs, observability systems, and diagnostic output. Although the reviewed text does not ...[truncated 1937 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.