Auto PieceOne

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:54 PM UTC
• Version: 1.0.0

Overview

The skill is a disclosed game automation helper, but it tells the agent to download changing code from GitHub and run it with desktop-control libraries without verification.

Review this before installing. The skill is not shown to be malicious, but following it would run whatever code is currently in a third-party GitHub repository, plus unpinned Python packages, on your machine with desktop automation access. Use a pinned, reviewed commit in an isolated environment and avoid running it against your normal desktop session.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILLS.md:55
• Finding: Unverified Mutable Remote Code Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILLS.md:55-87` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```python # 1. Clone repository exec(command="git clone https://github.com/imtonyjaa/autopieceone.git") # 2. Check browser tabs browser(action="tabs") # 3. Open game page (MUST include widget=2&from=claw) browser(action="open", targetUrl="https://piece.one/?widget=2&from=claw") # 4. Wait for game to load time.sleep(3) # 5. Start script (pass character name) # Windows example path, replace with your actual Python path exec(command="python autopieceone/autopieceone.py CharacterName") ``` ```python # 1. Pull latest code exec(command="git -C autopieceone pull") # 2. Close old tab and open new page browser(action="tabs") # Record old tab ID, then close it browser(action="close", targetId="<OldID>") browser(action="open", targetUrl="https://piece.one/?widget=2&from=claw") # 3. Start script exec(command="python autopieceone/autopieceone.py CharacterName") ``` ### Technical Analysis The Skill directs the Agent to clone a third-party GitHub repository and execute its Python script without pinning the repository to an immutable reviewed commit. It also instructs the Agent to run `git pull` before subsequent executions, causing the effective payload to change whenever the upstream branch changes. No checksum, cryptographic signature, release attestation, or source review is required before execution. The referenced source code is not included in the audited project, so its actual behavior cannot be independently verified from this package. Because the script uses system-level GUI automation, an altered payload may also interact with applications outside the game. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or the branch referenced by the default clone and pull operations. 2. The attacker modifies `autopieceone.py` or another imported file ...[truncated 915 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the executable source in the Skill package so it can be reviewed together with the instructions. 2. If remote retrieval is necessary, pin the repository to a specific immutable commit hash rather than executing the default branch. 3. Verify downloaded content against a trusted SHA-256 checksum or a cryptographically signed release before execution. 4. Do not automatically execute code after `git pull`. Display the revision and changed files and require explicit approval after review. 5. Run the automation in a dedicated, least-privileged environment with restricted filesystem and network access. 6. Limit GUI automation to an isolated browser session or virtual desktop so it cannot interact with unrelated applications. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILLS.md:29
• Finding: Python Dependencies Are Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILLS.md:29-33` **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install pyautogui pyperclip python-dotenv ``` ### Technical Analysis The installation command resolves the latest available versions of three third-party packages from the active pip package index. It provides no exact versions, package hashes, lockfile, index restriction, or signature verification. Consequently, installations performed at different times can retrieve different code. The resulting package can also depend on mutable transitive dependencies. Python packages may execute code during build or installation, and their modules execute code when imported by the downloaded automation script. ### Attack Path 1. An attacker compromises a named dependency, one of its transitive dependencies, its publisher account, or the package distribution channel. 2. A malicious or otherwise unsafe release becomes eligible for dependency resolution. 3. A user follows the documented unpinned `pip install` command. 4. pip downloads and installs the affected release. 5. Attacker-controlled code may execute during package build, installation, or subsequent import by the automation script. ### Impact Assessment Malicious dependency code would generally execute with the privileges of the user running pip or the Python automation. This could expose user-accessible files, environment variables, network access, and desktop automation capabilities. Installing with an elevated interpreter could increase the affected scope. No malicious dependency is demonstrated by the audited file. The confirmed issue is the absence of reproducible version and integrity controls. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct and transitive dependency to reviewed versions in a lockfile. 2. Generate and verify cryptographic hashes for all distributions, using pip's `--require-hashes` option. 3. Install packages in a dedicated virtual environment rather than the system Python environment. 4. Configure an explicitly trusted package index and avoid uncontrolled fallback indexes. 5. Prefer pre-reviewed binary wheels where appropriate and disable unnecessary source builds. 6. Add automated dependency vulnerability and provenance scanning, and update dependencies through a reviewed change process. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Windows**: [Download Python 3.12](https://www.python.org/downloads/)
- **Mac**: `brew install python3` or [Download from Official Site](https://www.python.org/downloads/macos/)
- **Linux**: `sudo apt install python3` or `sudo yum install python3`

Make sure to check **"Add Python to PATH"** during installation.

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent/user to clone a remote GitHub repository, pull updates, and execute its Python script directly on the host without any review, pinning, integrity verification, or safety warning. Because the repository can change over time and the script uses system-level automation libraries, this creates a realistic path to arbitrary code execution and unsafe host interaction.