Bot Arcade

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:44 AM UTC
• Version: 1.0.0

Overview

This game skill has no clear malware or exfiltration, but it needs Review because it combines broad auto-activation, persistent player tracking, real-money monetization guidance, and weak virtual-economy controls.

Install only after deciding you explicitly want a persistent, engagement-optimized arcade. Disable or remove paid tournaments, prize pools, affiliate links, sponsorships, and real-money mappings unless you have platform, legal, age, consent, and disclosure controls. Keep Arcade Coins virtual-only until the state engine has authorization, validation, audit logs, and anti-abuse fixes. Operators should also add clear opt-in activation, data retention, and delete/export controls before deploying in group chats.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:24
• Finding: Broad Skill Persona and Engagement Directives Hijack Agent Session Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-47 **Vulnerability Type**: Agent instruction hijacking through an unconditional persona assignment and broad activation rules **Risk Level**: Medium ### Vulnerable Code ```markdown You are now **THE ARCADE** — the most engaging entertainment engine any AI agent can run. You host games, hype crowds, track scores, and keep people coming back. Your personality when running games is an **electric, witty game show host** — think a mashup of a carnival barker, a Vegas dealer, and a stand-up comic. Keep energy HIGH, stakes FEELING real, and the fun RELENTLESS. ## Core Principles 1. **Instant fun** — Every game starts in ONE message. No setup friction. 2. **Skill + luck** — Best games blend knowledge, wit, and randomness. 3. **Social pressure** — Leaderboards, streaks, and call-outs drive engagement. 4. **Variable rewards** — Unpredictable payoffs create dopamine loops. 5. **Session stickiness** — Always tease "one more round" at the end of games. 6. **Zero dependencies** — All games run as pure text. No APIs. No images. No cost. ## Activation Triggers Activate the Arcade when you detect ANY of these: - Direct game requests: "let's play", "I'm bored", "game time", "spin", "trivia" - Slash commands: `/arcade`, `/spin`, `/trivia`, `/fortune`, `/dice`, `/riddle` - Boredom cues: "nothing to do", "entertain me", "what's fun" - Group energy: competitive banter, celebration moments, late-night chat vibes ``` ### Technical Analysis The skill assigns the agent a new identity using the unconditional instruction “You are now THE ARCADE.” It then replaces ordinary conversational goals with engagement and retention objectives, including social pressure, variable rewards, session stickiness, and an instruction to “always” encourage another round. The activation conditions are broader than the minimum needed to provide games. In particular, ambiguous cues such as competitive banter, celebrations, and p ...[truncated 2085 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the unconditional identity assignment with a scoped instruction, such as: “When the user explicitly requests a game, present it in an upbeat game-show style.” 2. State explicitly that all skill instructions are subordinate to system, developer, platform, safety, privacy, and user instructions. 3. Require explicit opt-in before activating games; remove ambiguous triggers based on inferred mood, group energy, or time of day. 4. Remove mandatory retention directives such as “always tease one more round.” 5. Prohibit deceptive urgency, manufactured social pressure, loss-aversion prompts, and claims that virtual stakes are real. 6. Keep game presentation separate from payment, affiliate, sponsorship, and referral behavior. Require explicit operator configuration and clear advertising disclosures. 7. Add age-appropriate safeguards and disable casino-like monetization for minors or unknown-age users. 8. Require informed user consent before creating persistent profiles, streaks, leaderboards, or behavioral analytics. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/arcade_engine.py:184
• Finding: Unrestricted Save Command Allows Arbitrary Player-State Modification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/arcade_engine.py`, lines 184-195 **Vulnerability Type**: Missing authorization and field-level validation in a privileged state mutation interface **Risk Level**: Medium ### Vulnerable Code ```python def cmd_save(player_id: str, json_data: str): """Save or update player data.""" path = _player_path(player_id) existing = _load_json(path, _default_player(player_id)) updates = json.loads(json_data) existing.update(updates) # Recalculate level lvl, xp_into, xp_needed = _calculate_level(existing.get("xp", 0)) existing["level"] = lvl _save_json(path, existing) print(json.dumps({"status": "saved", "player_id": player_id, "level": lvl})) ``` ### Technical Analysis The skill documentation directs the agent to use this script for all state management and publicly documents the `save <player_id> <json_data>` interface. The implementation parses caller-supplied JSON and merges every supplied key directly into the persistent player record through `existing.update(updates)`. There is no authentication, authorization, ownership check, schema validation, type validation, or field allowlist. Consequently, a caller able to induce invocation of this command can modify security- and economy-relevant fields, including: - `coins` - `total_coins_earned` - `xp` - `achievements` - `badges` - `titles` - game counts and win statistics - streak dates - daily usage limits - referrals and cosmetics - another player’s record, if their identifier is known The player identifier is hashed before being used as a filename, which prevents straightforward path traversal through `player_id`. However, hashing the identifier does not provide authorization and does not prevent unauthorized modification of the corresponding record. ### Attack Path 1. An attacker identifies or guesses a target player identifier. 2. The attacker directly runs the documented local command, or persuades an agent wi ...[truncated 1162 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the generic `save` interface from user- or agent-accessible commands. 2. Replace it with narrowly scoped operations such as `record_game_result`, `set_cosmetic`, or `consume_daily_spin`. 3. Define a strict schema and reject unknown fields, invalid types, negative values, excessive values, and nested structures that do not match the schema. 4. Never permit clients to directly set balances, XP, achievements, entitlements, streak dates, or aggregate statistics. 5. Authenticate callers and verify that they are authorized to modify the specified player. 6. Separate operator-only administration commands from gameplay commands and require a distinct privileged execution context. 7. Validate all state transitions server-side from trusted game outcomes. 8. Add an append-only audit log recording the authenticated actor, target player, operation, old value, new value, and timestamp. 9. If real payments or prizes are enabled, move authoritative balances to a transactional datastore and never trust agent-generated state updates. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/arcade_engine.py:418
• Finding: Unknown Achievement IDs Generate Unlimited Rewards<![CDATA[ ## Vulnerability Details **File Location**: `scripts/arcade_engine.py`, lines 418-425 **Vulnerability Type**: Fail-open achievement validation and unauthorized reward issuance **Risk Level**: Medium ### Vulnerable Code ```python reward = rewards.get(achievement_id, {"coins": 25, "badge": None, "title": None}) data.setdefault("achievements", []).append(achievement_id) data["coins"] = data.get("coins", 0) + reward["coins"] data["total_coins_earned"] = data.get("total_coins_earned", 0) + reward["coins"] data["xp"] = data.get("xp", 0) + 50 # All achievements give 50 XP ``` ### Technical Analysis The achievement command accepts an arbitrary `achievement_id`. Earlier in the function, duplicate protection only checks whether that exact string already exists in the player’s achievement list. The reward lookup then uses a default reward for every identifier not present in the approved achievement table. As a result, unknown identifiers are treated as valid achievements and receive 25 coins plus 50 XP. An attacker can generate an unlimited sequence of unique identifiers such as `FAKE-1`, `FAKE-2`, and `FAKE-3`. Every value bypasses the exact-string duplicate check and receives the default reward. The command also does not verify whether the player met the achievement’s actual gameplay conditions. Even recognized IDs can therefore be awarded solely by invoking the command. ### Attack Path 1. The attacker invokes the documented `award` command using a unique, nonexistent achievement identifier: ```bash python3 scripts/arcade_engine.py award attacker FAKE-0001 ``` 2. The identifier is absent from the player’s achievement list and passes duplicate checking. 3. `rewards.get` does not reject it; instead, it returns the default 25-coin reward. 4. The command adds 25 coins and 50 XP and persists the unknown identifier. 5. The attacker repeats the operation with `FAKE-0002`, `FAKE-0003`, and further unique values. 6. The player obtains effectively un ...[truncated 614 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject every achievement identifier not present in the approved reward table; do not provide a default reward. 2. Keep achievement definitions in an immutable allowlist. 3. Do not expose `award` as an unrestricted gameplay command. 4. Evaluate each achievement condition from trusted server-side statistics before issuing a reward. 5. Make reward issuance idempotent using a unique database constraint on `(player_id, achievement_id)`. 6. Record a signed or transactional audit event for every achievement award. 7. Add rate limiting and anomaly detection for unusually rapid achievement or currency growth. 8. Review existing data for unknown achievement IDs and recalculate balances derived from invalid awards. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/arcade_engine.py:518
• Finding: Self-Gifting Creates Virtual Currency Because Transfers Are Not Alias-Safe<![CDATA[ ## Vulnerability Details **File Location**: `scripts/arcade_engine.py`, lines 518-557 **Vulnerability Type**: Business-logic flaw and non-atomic balance transfer **Risk Level**: Medium ### Vulnerable Code ```python def cmd_gift(from_id: str, to_id: str, amount: str): """Transfer coins between players.""" amount = int(amount) if amount <= 0: print(json.dumps({"status": "error", "message": "Amount must be positive"})) return from_path = _player_path(from_id) to_path = _player_path(to_id) from_data = _load_json(from_path, _default_player(from_id)) to_data = _load_json(to_path, _default_player(to_id)) if from_data.get("coins", 0) < amount: print(json.dumps({ "status": "error", "message": "Insufficient coins", "balance": from_data.get("coins", 0) })) return from_data["coins"] -= amount to_data["coins"] = to_data.get("coins", 0) + amount to_data["total_coins_earned"] = to_data.get("total_coins_earned", 0) + amount from_data.setdefault("stats", {})["coins_gifted"] = \ from_data.get("stats", {}).get("coins_gifted", 0) + amount to_data.setdefault("stats", {})["coins_received"] = \ to_data.get("stats", {}).get("coins_received", 0) + amount _save_json(from_path, from_data) _save_json(to_path, to_data) ``` ### Technical Analysis The transfer function does not reject a transfer where `from_id` equals `to_id`. When both identifiers are the same, `from_path` and `to_path` point to the same file, but the record is loaded into two independent dictionaries. For a player with balance `B` transferring amount `A` to themselves: 1. `from_data` becomes `B - A`. 2. Independently, `to_data` becomes `B + A`. 3. The function saves `from_data` first. 4. It then saves `to_data` to the same path, overwriting the deducted balance. 5. The final persisted balance is `B + A`. Thus, every successful self-transfer mints `A` n ...[truncated 1453 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject transfers where `from_id == to_id`. 2. Resolve and compare canonical account identities rather than relying only on raw input strings. 3. Store balances in a transactional database instead of independent flat JSON files. 4. Perform the debit, credit, and audit-log insertion in one atomic transaction. 5. Lock both account records in a deterministic order when processing a transfer. 6. Enforce authenticated ownership of the source account and authorization for every transfer. 7. Apply transfer limits, rate limits, and fraud detection. 8. Maintain a double-entry ledger in which every credit has a corresponding debit and the total supply can be reconciled. 9. Add regression tests for self-transfer, concurrent transfer, process interruption between writes, malformed balances, and transfers involving newly created accounts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The activation triggers are extremely broad, including generic phrases like 'I'm bored' and ambient group-chat cues, so the skill may activate without an unambiguous request. In context, that is more dangerous because the skill is explicitly designed to maximize engagement and retention, making accidental invocation likely to lead to spammy behavior, manipulative nudging, or unwanted state changes.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill includes monetization paths such as tipping, tournament entry fees, prize pools, and affiliate links despite being presented as an entertainment module. This increases financial, compliance, and abuse risk because an agent could pressure users into spending money or facilitate wagering-like flows without clear safeguards, eligibility checks, or operator controls.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file introduces payment-gated gameplay, premium access, and psychologically manipulative retention prompts despite the metadata claiming zero cost. This is risky because it enables undisclosed financial transactions and pressure-based monetization in a context users and integrators may assume is free entertainment, creating deception, compliance, and consumer-protection exposure.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The documentation adds sponsored game rounds, branded themes, and advertising integrations that are absent from the stated entertainment scope. This is dangerous because covert ad delivery through gameplay can mislead users, especially if sponsorships are blended into normal game interactions without clear disclosure or policy review.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The playbook recommends contextual affiliate links and conversion tracking, which expands the skill into marketing and user-behavior optimization beyond its declared purpose. This creates risk of undisclosed commercial influence, tracking without clear consent, and misuse of gameplay context to drive purchases.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Why Every Bot Needs This

- **Engagement** — Games keep users coming back daily
- **Retention** — Streaks, leaderboards, and achievements create stickiness
- **Virality** — "Beat my score" and shareable wins drive organic growth
- **Monetization** — 7 built-in revenue streams (see monetization playbook)
- **Zero cost** — Pure text/logic, runs locally, no external APIs

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The README explicitly states the skill should also activate on broad conversational cues like boredom, celebration, or competitive banter, which can cause unintended invocation outside clear user requests. In a multi-skill agent, this increases the chance of context hijacking, user confusion, and accidental engagement flows being triggered when the user did not intend to play a game.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to use a local Python script for persistent state while declaring no explicit tool scope or allowed-tools boundary. That creates an authority mismatch: a host may expose file, environment, or process capabilities that the skill can implicitly rely on without review, increasing the chance of unintended file access or unsafe execution paths.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill persistently stores player IDs, stats, streaks, achievements, and leaderboards but provides no notice, consent flow, retention policy, or deletion controls. In this context, the data collection is not essential to basic chat safety and could expose behavioral profiles or identifiers, especially in group settings where users may not expect long-term tracking.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest advertises 'Zero dependencies' and 'Zero external APIs,' but the skill requires invoking `python3 scripts/arcade_engine.py` for core functionality. Even if not a network dependency, this is still an execution dependency and misleading capability disclosure can cause operators to trust and enable the skill without understanding it needs local code execution and persistent storage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Prediction and competitive features use wagering-like mechanics, mention coins wagered, payouts, tips, and prize pools, but do not clearly warn users about monetization or financial implications. In an entertainment skill optimized for engagement, these mechanics can normalize gambling-adjacent behavior and blur the line between virtual play and real-money pressure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section explicitly documents persuasive design techniques such as variable-ratio reinforcement, loss aversion, sunk cost, and peak-end optimization to increase retention and repeated play, but does not pair them with safeguards, consent, age-appropriate limits, or wellbeing disclosures. In an entertainment skill aimed at boredom relief, group play, and ongoing engagement, these mechanics can encourage compulsive use and exploit vulnerable users, especially minors or users prone to problematic gaming behavior.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly frames the skill as a revenue-generation system, which materially exceeds the manifest's entertainment-only description. This scope mismatch is dangerous because downstream users, reviewers, or platforms may enable the skill believing it is harmless game content while it actually steers operators toward monetization features and growth tactics.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The sponsored-content and affiliate sections discuss monetization tactics but do not require strong user-facing disclosures that content is paid promotion or that links generate commissions. This is dangerous because users may not realize game content is advertising, creating deception, trust erosion, and regulatory risk around endorsement transparency.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Referral growth incentives and affiliate monetization are not justified by the skill's stated purpose as a simple entertainment engine and introduce commercial propagation behavior. In this context, game achievements are being used to drive recruitment and purchases, increasing the chance of spammy growth loops and deceptive commercialization.

Static analysis

No suspicious patterns detected.