T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:24- Finding
Broad Skill Persona and Engagement Directives Hijack Agent Session Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Bot Arcade
Security checks for vulnerabilities and agentic risk
Overview
This game skill has no clear malware or exfiltration, but it needs Review because it combines broad auto-activation, persistent player tracking, real-money monetization guidance, and weak virtual-economy controls.
Install only after deciding you explicitly want a persistent, engagement-optimized arcade. Disable or remove paid tournaments, prize pools, affiliate links, sponsorships, and real-money mappings unless you have platform, legal, age, consent, and disclosure controls. Keep Arcade Coins virtual-only until the state engine has authorization, validation, audit logs, and anti-abuse fixes. Operators should also add clear opt-in activation, data retention, and delete/export controls before deploying in group chats.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/arcade_engine.py:184- Finding
Unrestricted Save Command Allows Arbitrary Player-State Modification
- Content
View full analysis
` interface. The implementation parses caller-supplied JSON and merges every supplied key directly into the persistent player record through `existing.update(updates)`. There is no authentication, authorization, ownership check, schema validation, type validation, or field allowlist. Consequently, a caller able to induce invocation of this command can modify security- and economy-relevant fields, including: - `coins` - `total_coins_earned` - `xp` - `achievements` - `badges` - `titles` - game counts and win statistics - streak dates - daily usage limits - referrals and cosmetics - another player’s record, if their identifier is known The player identifier is hashed before being used as a filename, which prevents straightforward path traversal through `player_id`. However, hashing the identifier does not provide authorization and does not prevent unauthorized modification of the corresponding record. ### Attack Path 1. An attacker identifies or guesses a target player identifier. 2. The attacker directly runs the documented local command, or persuades an agent wi ...[truncated 1162 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/arcade_engine.py:418- Finding
Unknown Achievement IDs Generate Unlimited Rewards
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/arcade_engine.py:518- Finding
Self-Gifting Creates Virtual Currency Because Transfers Are Not Alias-Safe
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The activation triggers are extremely broad, including generic phrases like 'I'm bored' and ambient group-chat cues, so the skill may activate without an unambiguous request. In context, that is more dangerous because the skill is explicitly designed to maximize engagement and retention, making accidental invocation likely to lead to spammy behavior, manipulative nudging, or unwanted state changes.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill includes monetization paths such as tipping, tournament entry fees, prize pools, and affiliate links despite being presented as an entertainment module. This increases financial, compliance, and abuse risk because an agent could pressure users into spending money or facilitate wagering-like flows without clear safeguards, eligibility checks, or operator controls.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file introduces payment-gated gameplay, premium access, and psychologically manipulative retention prompts despite the metadata claiming zero cost. This is risky because it enables undisclosed financial transactions and pressure-based monetization in a context users and integrators may assume is free entertainment, creating deception, compliance, and consumer-protection exposure.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation adds sponsored game rounds, branded themes, and advertising integrations that are absent from the stated entertainment scope. This is dangerous because covert ad delivery through gameplay can mislead users, especially if sponsorships are blended into normal game interactions without clear disclosure or policy review.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The playbook recommends contextual affiliate links and conversion tracking, which expands the skill into marketing and user-behavior optimization beyond its declared purpose. This creates risk of undisclosed commercial influence, tracking without clear consent, and misuse of gameplay context to drive purchases.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Why Every Bot Needs This - **Engagement** — Games keep users coming back daily - **Retention** — Streaks, leaderboards, and achievements create stickiness - **Virality** — "Beat my score" and shareable wins drive organic growth - **Monetization** — 7 built-in revenue streams (see monetization playbook) - **Zero cost** — Pure text/logic, runs locally, no external APIs
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README explicitly states the skill should also activate on broad conversational cues like boredom, celebration, or competitive banter, which can cause unintended invocation outside clear user requests. In a multi-skill agent, this increases the chance of context hijacking, user confusion, and accidental engagement flows being triggered when the user did not intend to play a game.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to use a local Python script for persistent state while declaring no explicit tool scope or allowed-tools boundary. That creates an authority mismatch: a host may expose file, environment, or process capabilities that the skill can implicitly rely on without review, increasing the chance of unintended file access or unsafe execution paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill persistently stores player IDs, stats, streaks, achievements, and leaderboards but provides no notice, consent flow, retention policy, or deletion controls. In this context, the data collection is not essential to basic chat safety and could expose behavioral profiles or identifiers, especially in group settings where users may not expect long-term tracking.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest advertises 'Zero dependencies' and 'Zero external APIs,' but the skill requires invoking
python3 scripts/arcade_engine.pyfor core functionality. Even if not a network dependency, this is still an execution dependency and misleading capability disclosure can cause operators to trust and enable the skill without understanding it needs local code execution and persistent storage.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Prediction and competitive features use wagering-like mechanics, mention coins wagered, payouts, tips, and prize pools, but do not clearly warn users about monetization or financial implications. In an entertainment skill optimized for engagement, these mechanics can normalize gambling-adjacent behavior and blur the line between virtual play and real-money pressure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section explicitly documents persuasive design techniques such as variable-ratio reinforcement, loss aversion, sunk cost, and peak-end optimization to increase retention and repeated play, but does not pair them with safeguards, consent, age-appropriate limits, or wellbeing disclosures. In an entertainment skill aimed at boredom relief, group play, and ongoing engagement, these mechanics can encourage compulsive use and exploit vulnerable users, especially minors or users prone to problematic gaming behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly frames the skill as a revenue-generation system, which materially exceeds the manifest's entertainment-only description. This scope mismatch is dangerous because downstream users, reviewers, or platforms may enable the skill believing it is harmless game content while it actually steers operators toward monetization features and growth tactics.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The sponsored-content and affiliate sections discuss monetization tactics but do not require strong user-facing disclosures that content is paid promotion or that links generate commissions. This is dangerous because users may not realize game content is advertising, creating deception, trust erosion, and regulatory risk around endorsement transparency.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Referral growth incentives and affiliate monetization are not justified by the skill's stated purpose as a simple entertainment engine and introduce commercial propagation behavior. In this context, game achievements are being used to drive recruitment and purchases, increasing the chance of spammy growth loops and deceptive commercialization.
- Content