Security audit

《厨房战争》全面红警化，并在多个维度做了"超越"。

Security checks for vulnerabilities and agentic risk

Overview

This is a self-contained browser game skill with local test scripts and no evidence of hidden data access, network exfiltration, or destructive behavior.

Install only if you want this specific Kitchen War / Red Alert-style browser RTS workflow. Be aware it may activate for broader browser strategy game requests, and its verification scripts expect local Playwright/Node availability and will open the bundled HTML game in a browser.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger language is broad enough that the skill could activate on loosely related requests for strategy games or browser games, causing unintended use of this skill instead of a more appropriate one. Over-broad invocation increases the chance of unnecessary file copying, browser preview actions, or test execution in contexts the user did not actually request.

Vague Triggers

Low

Confidence: 80% confidence
Finding: The trigger language is broad enough that the skill could activate on loosely related requests for strategy games or browser games, causing unintended use of this skill instead of a more appropriate one. Over-broad invocation increases the chance of unnecessary file copying, browser preview actions, or test execution in contexts the user did not actually request.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/verify_game.js:140