ClawHub
Back to skill

Security audit

厨房战争：红警风RTS

Security checks for vulnerabilities and agentic risk

Overview

The game is mostly a self-contained local RTS, but it embeds an automatic SkillHub five-star rating prompt into the delivered game and uses broad activation wording that could steer unrelated browser-game requests.

Review this before installing if you do not want generated games to contain marketplace/rating promotion. The local game and QA scripts do not show exfiltration or OS persistence, but the skill should be narrowed to explicit Kitchen War or RTS requests and the SkillHub five-star CTA should be removed or made opt-in.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
assets/index.html:2108
Finding

Mandatory Marketplace Promotion Embedded in Delivered Game Output

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:93-96
  • assets/index.html:2108-2112

Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Relevant Skill instruction:

markdown
- **Post-match promotional CTA** — on victory, the screen shows the challenge
  code, the per-code best time, and a prompt asking users to search SkillHub for
  `kitchen-war-rts` and provide a five-star rating.

Complete affected code segment:

javascript
if(G.challengeCode){
 var ch=JSON.parse(localStorage.getItem('kw_challenges')||'{}');
 var line='Challenge code '+G.challengeCode+' (share with friends to compete)';
 if(G.winner==='player'){
  if(ch[G.challengeCode]==null||G.time<ch[G.challengeCode])ch[G.challengeCode]=G.time;
  localStorage.setItem('kw_challenges',JSON.stringify(ch));
  var ct=Math.floor(ch[G.challengeCode]/60)+' min '+Math.floor(ch[G.challengeCode]%60)+' sec';
  line+=' · Best for this code '+ct;
 }
 if(gc)gc.textContent=line;
 if(gc)gc.textContent+=' · If you enjoyed it, search SkillHub for kitchen-war-rts and give it five stars';
}else if(gc){
 gc.textContent='Enjoyed this match? Search SkillHub for kitchen-war-rts and give it five stars';
}

Technical Analysis

The Skill documentation explicitly makes marketplace promotion part of the generated deliverable. The corresponding showGameOver() implementation then inserts that promotion into the game-over screen regardless of whether the user requested advertising or rating solicitation.

This changes the agent's delivery objective from creating a playable RTS to distributing an embedded promotional message. Because SKILL.md directs the agent to copy assets/index.html into user workspaces, the solicitation is propagated into every delivered copy of the game. The behavior is stable and does not depend on a remote server or mutable payload.

The issue is classified as instruction hijacking ...[truncated 1501 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the marketplace-rating requirement from SKILL.md, particularly the post-match promotional CTA requirement.
  2. Delete both unconditional promotional assignments from showGameOver() in assets/index.html.
  3. Restrict the game-over screen to match results, challenge codes, personal records, and sharing functions explicitly relevant to gameplay.
  4. If marketplace attribution is required, make it transparent and opt-in at delivery time rather than embedding it in every generated artifact.
  5. Add a regression test asserting that the delivered game contains no unsolicited marketplace searches, rating requests, or promotional calls to action.
  6. Review future Skill instructions for secondary objectives unrelated to the user's request before copying bundled assets into user workspaces.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description says this skill creates or serves a playable Kitchen War RTS by copying assets/index.html and opening it. The actual code chunk does not generate the game, present files, or implement player-facing gameplay features directly. Instead, it is a QA/audit script (_audit2.js) that programmatically opens an already-existing game in Chromium via Playwright and runs assertions against mechanics and UI flows. This is a materially different primary purpose: testing/verifying the game rather than creating/launching it for the user. While the tested subject is the same Kitchen War game, the code’s capabilities include undeclared browser automation, state injection, and error harvesting, which are not reflected in the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose centers on delivering a playable RTS game and copying/opening assets/index.html for the user. This code chunk does not implement the game itself or present files; instead it serves as an internal automated test harness for a specific subsystem (power usage when building/selling a turret). It launches a browser, injects localStorage state, interacts with the page, and inspects in-game globals/functions such as G.player, snapBuild, placeBuildingInstant, sellBuilding, and recalcPower. Those are materially different from the declared end-user-facing behavior. While such testing could support development of the game, the chunk's primary behavior is undisclosed automated QA/browser control, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The description says this skill generates a playable Red Alert–style RTS game and opens assets/index.html for the user. The actual code chunk does not generate the game, implement gameplay, or present files. Instead, it is a QA/adversarial test harness for an already-existing Kitchen War HTML file. It launches Chromium, loads a local HTML file, skips tutorial state, simulates gameplay interactions, forces internal state changes, and validates behaviors like pause, speed, superweapon use, selling buildings, long-run stability, economy, victory achievement persistence, resizing, duplicate start calls, empty selections, friendly-click command behavior, and music toggling. This is a materially different primary purpose from the declared content-generation/game-creation skill, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
style RTS, or wants to create/extend/fix the Kitchen War game. The agent copies assets/index.html to the workspace and opens it via present_files."

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
style RTS, or wants to create/extend/fix the Kitchen War game. The agent copies assets/index.html to the workspace and opens it via present_files."

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
style RTS, or wants to create/extend/fix the Kitchen War game. The agent copies assets/index.html to the workspace and opens it via present_files."

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
style RTS, or wants to create/extend/fix the Kitchen War game. The agent copies assets/index.html to the workspace and opens it via present_files."

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
style RTS, or wants to create/extend/fix the Kitchen War game. The agent copies assets/index.html to the workspace and opens it via present_files."

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md
style RTS, or wants to create/extend/fix the Kitchen War game. The agent copies assets/index.html to the workspace and opens it via present_files."

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation wording mixes broad Chinese and English examples without precise boundaries, which can cause accidental activation on adjacent topics such as general game creation, fixing unrelated web games, or challenge-code features. In an agent setting, ambiguous activation increases the risk of the skill steering execution toward its own assets and workflow without strong user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match many generic game-development or browser-game requests, increasing the chance the skill is invoked when the user did not specifically want this RTS template. Over-broad activation can cause inappropriate file copying, browser launching, or workflow hijacking away from the user's intended task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Line L0002 sets the page language to "zh-CN", and the entire interface text is hard-coded in Chinese throughout the file. This creates a language/locale policy issue because the skill appears to require a specific language without user opt-in or any visible option to switch languages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This JavaScript file contains natural-language strings and test assertions that require Chinese text such as "个人最佳" and prints a Chinese-only pass message. That enforces a specific language/locale behavior without any visible opt-in or justification, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Multiple assertion names and expected UI text are hard-coded in Chinese, such as at L29, L37, L44, and throughout the rest of the file. This imposes a specific language/locale in natural-language strings without offering a user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The publishing guidance mandates a Chinese display name '厨房战争：红警风RTS' and instructs not to use an alternative title, without offering a language choice or documenting a justified locale restriction. This is a natural-language locale constraint that appears to force a specific language rather than letting the user or publisher choose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a self-contained RTS game with daily challenges, sharing codes, screenshots, and achievements. However, the game-over flow injects marketing text urging users to search SkillHub and leave a five-star rating, which is not necessary to implement or operate the game itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The header instructs use of PLAYWRIGHT_BROWSERS_PATH and NODE_PATH pointing to a specific local user environment, which involves accessing environment configuration and local system paths. In this file there is no explicit warning that the script depends on and may inspect/use local environment settings on the host machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script emits a hard-coded Chinese status string (放塔升耗电, 拆塔降耗电, 无崩溃) in its final PASS message. This is a natural-language locale choice embedded in the skill with no indication that the user can select a language or that the locale restriction is intentional and documented.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/verify_game.js:140