ClawHub
Back to skill

Security audit

LLM Skirmish

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent guide for a game CLI, with expected account, upload, and replay features, but users should treat its API key, submissions, and unpinned npm install carefully.

Install only if you trust the llmskirmish npm package and service. Avoid sudo/admin installs, protect or remove the local credentials file when finished, and review scripts, images, and replay logs before using commands that submit, upload, or open them through llmskirmish.com.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Global npm Package Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15-18; references/CLI.md:4-8
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:15-18:

markdown
## Installation

```bash
npm install -g @llmskirmish/skirmish
text

`references/CLI.md:4-8`:

```markdown
## Installation

```bash
npm install -g @llmskirmish/skirmish

Requires Node.js 18+.

text

### Technical Analysis

The installation instructions retrieve the latest registry release of `@llmskirmish/skirmish` without specifying an exact version, lockfile, integrity hash, or other immutable verification mechanism. The CLI source is also not included in the audited project, so its implementation and npm lifecycle behavior cannot be verified from this artifact.

npm packages can define installation lifecycle scripts that execute during installation. Because this command installs a mutable third-party package globally, a compromised publisher account, malicious future release, or compromised dependency could cause code that was not present during this audit to execute on a user's system.

The scoped package name is consistent with the declared Skirmish service, and the reviewed files contain no evidence that the package is intentionally malicious or typosquatted. The vulnerability is the unsafe, unpinned supply-chain trust model rather than confirmed malicious package behavior.

### Attack Path

1. An attacker compromises the npm publisher account, package release process, or a transitive dependency used by `@llmskirmish/skirmish`.
2. The attacker publishes a malicious version or introduces malicious lifecycle behavior.
3. A user follows the Skill's documented command, which resolves the package name to the current mutable registry release.
4. npm downloads the compromised package and may execute its lifecycle scripts during global installation.
5. The malicious code runs with the privile
...[truncated 713 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed exact version, for example:

    bash
    npm install -g @llmskirmish/skirmish@1.0.0

  2. Prefer a project-local dependency recorded in package.json and protected by a committed lockfile rather than a global installation.

  3. Publish and verify package provenance, signatures, or integrity hashes through a trusted release process.

  4. Review the package and its transitive dependencies, including all npm lifecycle scripts, before recommending installation.

  5. Avoid elevated installation privileges and explicitly warn users not to run the command with sudo or as an administrator.

  6. Where operationally feasible, initially install with lifecycle scripts disabled for inspection:

    bash
    npm install --ignore-scripts @llmskirmish/skirmish@1.0.0

    Lifecycle scripts should only be enabled after confirming that they are necessary and safe.

  7. Add automated dependency monitoring and release review so the documented version is updated only after each new release has been assessed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
2. Creates `strategies/` folder with example scripts
3. Creates `maps/` folder with map data

Credentials are saved to `~/.config/skirmish/credentials.json` on Unix (or `$XDG_CONFIG_HOME/skirmish/`) and `~/.skirmish/credentials.json` on Windows.

Run `skirmish init --force` to create a new identity.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md
2. Creates `strategies/` folder with example scripts
3. Creates `maps/` folder with map data

Credentials are saved to `~/.config/skirmish/credentials.json` on Unix (or `$XDG_CONFIG_HOME/skirmish/`) and `~/.skirmish/credentials.json` on Windows.

Run `skirmish init --force` to create a new identity.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md
2. Creates `strategies/` folder with example scripts
3. Creates `maps/` folder with map data

Credentials are saved to `~/.config/skirmish/credentials.json` on Unix (or `$XDG_CONFIG_HOME/skirmish/`) and `~/.skirmish/credentials.json` on Windows.

Run `skirmish init --force` to create a new identity.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/CLI.md (reported line 51)May include surrounding context.

md
2. Creates `strategies/` folder with example scripts
3. Creates `maps/` folder with map data

Credentials are saved to `~/.config/skirmish/credentials.json` on Unix (or `$XDG_CONFIG_HOME/skirmish/`) and `~/.skirmish/credentials.json` on Windows.

Run `skirmish init --force` to create a new identity.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/CLI.md (reported line 373)May include surrounding context.

md
2. Creates `strategies/` folder with example scripts
3. Creates `maps/` folder with map data

Credentials are saved to `~/.config/skirmish/credentials.json` on Unix (or `$XDG_CONFIG_HOME/skirmish/`) and `~/.skirmish/credentials.json` on Windows.

Run `skirmish init --force` to create a new identity.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/CLI.md (reported line 374)May include surrounding context.

md
2. Creates `strategies/` folder with example scripts
3. Creates `maps/` folder with map data

Credentials are saved to `~/.config/skirmish/credentials.json` on Unix (or `$XDG_CONFIG_HOME/skirmish/`) and `~/.skirmish/credentials.json` on Windows.

Run `skirmish init --force` to create a new identity.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly tells users that an API key is created and stored locally, but it omits any warning that the file is sensitive or should be protected, rotated, or removed when no longer needed. In a skill that guides installation and authentication for a remote service, this omission increases the chance of accidental credential exposure through backups, repo commits, shared machines, or logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The submit command uploads a local script to an external community ladder, but the skill does not clearly warn that local code leaves the machine and may become publicly associated with the user's identity. This can cause unintentional disclosure of proprietary logic, embedded secrets, or personal attribution information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/CLI.md (reported line 50)May include surrounding context.

md
### What it does

1. Registers with llmskirmish.com to create your identity
2. Saves API key to `~/.skirmish/credentials.json`
3. Creates `strategies/` folder with:
   - `example_1.js` — Aggressive melee rush strategy

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The replay viewer documentation states that match logs are compressed, encoded, and opened via a https://llmskirmish.com/localmatch#data=... URL, but it does not warn users that local match contents are being embedded into a browser URL and sent to a remote site context. Even if the fragment is primarily client-side, this workflow can expose strategy code, game telemetry, or sensitive log contents through browser history, screenshots, copied URLs, extensions, or unexpected handling by the site.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The profile picture command accepts a local file path and implies upload to the remote service, but the documentation does not clearly state that the selected file will be transmitted off-host. This can lead users to unintentionally send local content they did not mean to disclose, though the impact is limited to the chosen file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skirmish auth status example displays an API key in plaintext without any warning that it is a sensitive secret. This can normalize unsafe handling of credentials and lead users to paste, screenshot, or share terminal output containing active authentication material.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.