Security audit
Security checks for vulnerabilities and agentic risk
The playable game is mostly local and coherent, but the package also includes credential-backed marketplace publishing that can mutate a SkillHub account.
Review this skill before installing if you do not intend to publish or update SkillHub store listings. The game file itself appears local, but do not run scripts/publish_skillhub_store.js unless you understand it will read your SkillHub credentials and submit files to the store API.
The advertised purpose is generating and presenting a browser RTS game, but the documentation also includes authenticated store-publishing workflows, credential-file access, and remote uploads. This mismatch is dangerous because users and orchestrators may invoke the skill expecting local game generation while it also enables unrelated privileged actions against external services.
The skill documentation identifies a local credential file path and explains that a store token is stored there for authenticated operations. Even without code execution in this file, instructing an agent to use local secrets from a known path is dangerous because it encourages secret discovery and use outside the stated purpose of the skill.
2. **SkillHub 商店前台**（skillhub.cn / skillhub.cloud.tencent.com，用户浏览的目录）：
**`clawhub publish --site https://skillhub.cn` 只写 clawhub 兼容注册表镜像，并不会在
SkillHub 商店前台建/更新条目。** 商店前台是独立 catalog，用独立的 `skh_...` token
（存于 `~/.skillhub/credentials.json`，不是 clawhub 的 `clh_...` token）。
本技能在 SkillHub 商店的真实条目 slug 是 **`war-skill`**（owner `user_98676efe`），
**不是** `kitchen-war-rts`。用同一 slug + 更高 version 提交即为"更新到新版"。
The documentation explicitly directs use of locally stored SkillHub credentials and authenticated external API publishing, which is unnecessary for a game-generation skill and introduces a direct path to account misuse. In this context, referencing credential files and bearer-token publication materially increases risk because it normalizes reading sensitive local secrets and sending local files to a remote service.
This line directly instructs running a script that automatically reads ~/.skillhub/credentials.json to obtain a publishing token. That creates a concrete path from innocuous skill invocation to secret consumption and authenticated external actions, which is especially risky given the skill's publicly described purpose is just generating a game.
发布/更新到 SkillHub 商店前台（必须走 store API，不能用 clawhub publish --site）：
# 用托管 Node 运行本技能自带的脚本（自动读 ~/.skillhub/credentials.json 的 skh_ token）
"C:/Users/www74/.workbuddy/binaries/node/versions/22.22.2-2/node.exe" ^
"C:/Users/www74/.workbuddy/skills/kitchen-war-rts/scripts/publish_skillhub_store.js" 1.0.4
The file header explicitly documents that a SkillHub token is stored in ~/.skillhub/credentials.json and that the script targets a separate store API using that credential. While documentation alone is not exploit code, it advertises credential access behavior and supports a real implementation that can perform authenticated account actions, which raises the severity in a package whose stated purpose is just generating a browser game.
* 重要事实（2026-09-08 验证）：
* - `clawhub publish --site https://skillhub.cn` 只写 **clawhub 兼容注册表镜像**，
* 并不会在 SkillHub **商店前台目录**建/更新条目。商店前台用独立的 store API。
* - SkillHub 商店目录 API 用独立的 `skh_...` token（存于 ~/.skillhub/credentials.json），
* 不是 clawhub 的 `clh_...` token。
* - 本技能的商店条目 slug 是 `war-skill`（owner `user_98676efe`），不是 `kitchen-war-rts`。
* 用同一 slug + 更高 version 提交即为"更新到新版"（upsert）。
This line constructs the path to a local credential store and is part of a flow that reads the token and uses it for authenticated publishing. Accessing local credentials from within a gameplay skill is a high-risk capability because compromise or misuse can result in unauthorized updates to the user's SkillHub account or associated store entries.
const fs = require('fs');
const path = require('path');
const CRED = path.join(process.env.USERPROFILE || process.env.HOME, '.skillhub', 'credentials.json');
const SKILL_DIR = path.resolve(__dirname, '..');
// slug / 显示名可用环境变量覆盖：SKH_SLUG、SKH_DISPLAY
// 默认 war-skill（老条目）。发与 clawhub 一致的别名时：SKH_SLUG=kitchen-war-rts SKH_DISPLAY="厨房战争：红警风RTS"
The skill requests or documents capabilities that imply environment access and network use, but it does not declare a corresponding tool/permission scope. That weakens transparency and policy enforcement, making it easier for a seemingly harmless game skill to perform higher-risk actions such as reading local state and contacting remote services without clear user expectation.
The manifest description says to use the skill when the user asks for "能玩的网页游戏" and similar broad requests. That phrase is not specific to this Kitchen War / RTS skill and could overlap with many generic browser-game requests, increasing the chance of unintended invocation.
Phrases like "playable browser RTS game" and especially "做个能玩的战略游戏" are broad enough to match many ordinary requests for strategy games, not just this skill's intended Kitchen War / Red Alert-style implementation. The section also lacks explicit boundaries for when similar but different game requests should not use this skill.
Embedding marketplace publishing and store-management procedures in a game-generation skill expands the operational scope beyond what is needed to build or deliver the RTS. That creates a confused-deputy risk where an agent using this skill may be steered into account or publishing operations unrelated to the user's game request.
This script reads a local SkillHub credential file and uses the recovered bearer token to publish content to a remote store API. That is a privileged capability unrelated to the advertised gameplay function of the skill, so bundling it inside the skill increases the risk of unauthorized account actions if the script is run by a user or automation that did not expect store-side mutations.
The script silently loads a bearer token from ~/.skillhub/credentials.json and proceeds to use it without any user-facing disclosure or consent prompt. This is dangerous because a user inspecting or running a game-related skill would not reasonably expect local account credentials to be accessed for authenticated remote actions.
The script uploads multiple local files to a remote SkillHub API with no explicit warning that project contents will be transmitted over the network. In the context of a playable RTS skill, undisclosed exfiltration of local files to a third-party service is risky because users may execute it without realizing it performs publication rather than local game functionality.
The description says to use the skill when the user "wants to create/extend/fix the Kitchen War game," but it does not clearly delimit how the agent knows the request is about this specific project versus a generic game-editing request. Without negative examples or context constraints, activation scope is underspecified.
The document root explicitly sets lang="zh-CN", and the entire user-facing interface text is written in Chinese with no visible language toggle or opt-in. Under the stated policy, forcing a specific language/locale without user choice is a natural-language policy concern.
Detected: suspicious.dynamic_code_execution