Gaming Backlog Guide

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.0.0

Overview

This skill is a small, local game-backlog recommendation helper with no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Safe to install for ordinary personal use. Treat generated Markdown as advice, not as trusted instructions from the platform, especially if the input text came from another person or an untrusted source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: handler.py:230

Finding

Unsanitized User Input Enables Markdown Output Injection

Content

View full analysis

Vulnerability Details

File Location: handler.py, lines 230-236
Vulnerability Type: Markdown output injection through unsanitized user-controlled fields
Risk Level: Medium

Vulnerable Code

python

lines.append(f'- Platform read: {platform}')
if minutes:
    lines.append(f'- Available time: about {minutes} minutes')
else:
    lines.append('- Available time: not fully specified, so the guide defaults to lower-friction choices first.')
lines.append(f'- Budget pressure: {budget}')
lines.append(f'- Recent pattern: {recent}')

Technical Analysis

The platform, budget, and recent variables originate from the caller-controlled args["input"] value. They are interpolated directly into a Markdown response without escaping Markdown metacharacters, removing line breaks, restricting their length, or otherwise validating their structure.

An attacker can supply embedded newlines and Markdown syntax to terminate the intended list item and create arbitrary headings, links, or misleading instructions. For example, a platform value such as:

text

Switch

## Required Action
[Sign in to continue](https://attacker.example)

would cause the generated response to contain a forged section that may appear to be trusted skill output. The vulnerability affects presentation integrity rather than granting direct code execution.

Attack Path

1. An attacker supplies a crafted dictionary or JSON object through args["input"].
2. _coerce_input() accepts and normalizes the object without constraining field content.
3. _pick() and _score_profiles() propagate the crafted platform, budget, or recent-game value.
4. _build_result() directly interpolates the value into Markdown.
5. A client renders the response as trusted Markdown.
6. The injected headings, links, or instructions appear as part of the legitimate recommendation and may mislead the user into following attacker-control ...[truncated 711 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all values derived from args["input"] as untrusted presentation data.
2. Replace carriage returns, line feeds, and other control characters with spaces before inserting values into inline Markdown fields.
3. Escape Markdown-significant characters such as backslashes, backticks, brackets, parentheses, asterisks, underscores, hash characters, angle brackets, and pipe characters.
4. Enforce explicit type and maximum-length constraints for fields such as platform, budget, and recent games.
5. Prefer structured output fields over concatenated Markdown when the caller can render the response itself.
6. If Markdown output is required, place untrusted values in safely escaped code spans or quoted blocks and use a renderer configured to disable raw HTML and unsafe URL schemes.
7. Add regression tests using multiline values, headings, links, raw HTML, control characters, and oversized input to confirm that user data cannot alter the response structure.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · handler.py (reported line 67)May include surrounding context.

python

def _load_prompt_template(skill_name: str) -> str:
    del skill_name
    return PROMPT_TEMPLATE


def _normalize_key(key: Any) -> str:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The normalization pattern explicitly preserves Chinese characters, and later logic relies on Chinese field names as supported inputs. This introduces a built-in locale preference in the skill behavior without any visible user opt-in or statement that language choice is configurable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill accepts specific Chinese keys such as '心情', '空闲时间', '平台', '预算', '最近在玩', and '想要的体验' directly in its matching logic. While multilingual support can be beneficial, this is a locale-specific behavior that is not presented as a user choice or documented justification within the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.