3D Game Builder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:15 PM UTC
• Version: 1.2.0

Overview

The skill can build 3D browser games, but it also automatically publishes generated files to a public third-party URL and has unsafe local server process handling.

Review this skill before installing. It is suitable for generating local Three.js games, but it should not publish to here.now unless you explicitly want the generated game, embedded assets, and any build metadata made public. Avoid using private images or sensitive prompts with it unless publication is disabled or confirmed. The local server helper should also be treated cautiously in shared environments because its PID file handling can affect unrelated same-user processes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: SKILL.md:334

Finding

Automatic Third-Party Publication Can Expose User-Provided Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64-67 and 334-341
Vulnerability Type: Unintended Data Exposure
Risk Level: High

Vulnerable Code

text

If the user provides actual texture images, embed them as base64 data URIs in the HTML

bash

bash /home/ke/.agents/skills/here-now/scripts/publish.sh /tmp/game-build

text

This uploads the game and returns a live URL like `https://bright-canvas-a7k2.here.now/`. The link lasts 24 hours (anonymous) or permanently (with `HERENOW_API_KEY`).

Technical Analysis

The Skill directs the agent to embed user-provided images into the generated HTML and then automatically publish the entire /tmp/game-build directory through an external here.now publishing script. Publication is prescribed as a standard post-build action rather than an explicit, informed, opt-in operation.

Embedding an image as a base64 data URI does not protect it; it places the complete image data in the published HTML. Any party able to access the resulting URL can extract the original data. Other files in the build directory may also be uploaded, including progress.md, which records the original request, current state, and iteration history.

The publisher resides outside the audited project at /home/ke/.agents/skills/here-now/scripts/publish.sh. Its implementation and handling of uploaded data could not be verified as part of this audit.

Attack Path

1. A user supplies a private image or other sensitive game asset.
2. The Skill embeds that content into /tmp/game-build/index.html as a base64 data URI.
3. The Skill invokes the external publish.sh script on the complete build directory.
4. The external service returns a publicly shareable URL.
5. Anyone who obtains or discovers the URL can download the HTML, decode the embedded asset, and access other uploaded build files.
6. If HERENOW_API_KEY is configured, the publication may remain available permanently rather than expiring after 24 ...[truncated 502 chars]

Remediation

View remediation

Remediation Suggestions

• Make third-party publication explicitly opt-in; local serving should be the default.
• Obtain informed user confirmation immediately before each upload.
• Clearly identify the destination service, retention period, and public accessibility.
• Display the exact files that will be uploaded and allow the user to approve or exclude each one.
• Publish from a dedicated staging directory containing only required public artifacts.
• Exclude progress.md, prompts, iteration records, temporary files, and unrelated assets.
• Warn users that base64-embedded images remain fully recoverable from published HTML.
• Avoid embedding sensitive user assets unless the user explicitly requests public inclusion.
• Vendor and audit the publishing implementation, or pin it to a verified immutable version.
• Provide a deletion or revocation mechanism for previously published content.
• Do not use authenticated permanent publication unless the user separately confirms that choice.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/serve.sh:8

Finding

Predictable Shared Temporary PID File Allows Process Termination and File Truncation

Content

View full analysis

Vulnerability Details

File Location: scripts/serve.sh, lines 8-13, 26-29, and 46-47
Vulnerability Type: Unsafe Temporary File and Unvalidated PID Handling
Risk Level: Medium

Vulnerable Code

bash

PID_FILE="/tmp/build-game-server.pid"

if [[ "${1:-}" == "--stop" ]]; then
    if [[ -f "$PID_FILE" ]]; then
        kill "$(cat "$PID_FILE")" 2>/dev/null && echo "Server stopped." || echo "Server already stopped."
        rm -f "$PID_FILE"
    else
        echo "No server running."
    fi
    exit 0
fi

bash

# Kill any previous server
if [[ -f "$PID_FILE" ]]; then
    kill "$(cat "$PID_FILE")" 2>/dev/null || true
    rm -f "$PID_FILE"
fi

bash

python3 -m http.server "$PORT" --directory "$DIR" --bind 127.0.0.1 >/dev/null 2>&1 &
echo $! > "$PID_FILE"

Technical Analysis

The script stores process state at the fixed, predictable path /tmp/build-game-server.pid. Shared temporary directories are generally writable by other local users. The script trusts the file without validating:

• Whether the file is owned by the current user.
• Whether it is a regular file rather than a symbolic link.
• Whether its contents are a valid numeric PID.
• Whether the referenced process is the HTTP server created by this script.
• Whether another script instance is concurrently modifying the file.

When the script starts or receives --stop, it reads the file and passes its contents directly to kill. An attacker who can prepare the file can therefore select an unrelated process to signal, subject to the caller's normal process-signaling permissions.

The write operation echo $! > "$PID_FILE" follows symbolic links. If an attacker places a symlink at the predictable path, running the script can truncate and overwrite a file writable by the caller. The prior [[ -f "$PID_FILE" ]] check does not provide protection because it follows symlinks, and the check/use sequence is also susceptible to a time-of-check-to-time-of-use race.

Atta

...[truncated 1505 chars]

Remediation

View remediation

Remediation Suggestions

• Store runtime state under a private, caller-owned directory such as ${XDG_RUNTIME_DIR} rather than directly under shared /tmp.
• Create the runtime directory with mode 0700 and verify its ownership before use.
• Create the PID file atomically with restrictive permissions and refuse to follow symbolic links.
• Use mktemp or an atomic creation method with shell noclobber semantics.
• Add process locking, such as flock, to prevent concurrent instances from racing over the same state.
• Validate that PID-file contents contain only a positive integer before invoking kill.
• Before signaling, verify that the PID belongs to the current user and that its command line or executable corresponds to the expected python3 -m http.server instance.
• Prefer tracking the exact child process within the current execution context instead of trusting pre-existing shared state.
• Use cleanup traps to remove state safely on normal exit and termination.
• If a stable state path is required, reject symbolic links and verify the file's owner, permissions, inode, and type immediately before reading or writing it.
• Use a per-user or per-instance PID-file name to prevent collisions between users and concurrent game servers.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is local game generation, but it also orchestrates server lifecycle behavior such as port scanning, PID handling, and process management via helper scripts. That extra operational capability increases attack surface and surprises users/operators, especially in shared environments where killing or replacing an existing server process could affect unrelated workloads.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

- **Game systems** needed (check reference/game-systems.md):

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · reference/game-systems.md (reported line 986)May include surrounding context.

md

- **Start simple, then layer systems.** Get movement + one core mechanic working first.
- **Keep data definitions separate from logic.** SPECIES, ITEMS, QUESTS, DIALOGUES should all be plain objects at the top.
- **Mode manager is essential.** Every complex game needs clear state separation between overworld/battle/menu/dialogue.
- **localStorage for persistence.** Save on every significant event (battle won, item acquired, zone change).
- **Performance budget.** Complex games need more aggressive optimization: instanced meshes, object pooling, LOD switching, frustum culling.
- **UI layering.** Use z-index to manage overlapping UI modes. Only one mode-ui should be visible at a time.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · reference/gui-patterns.md (reported line 64)May include surrounding context.

md

<div id="health-container" style="position:absolute; bottom:24px; left:24px;">
    <div class="hud-label">HEALTH</div>
    <div style="position:relative; width:220px; height:14px; background:rgba(0,0,0,0.5); border-radius:7px; overflow:hidden; border:1px solid rgba(255,255,255,0.08);">
        <!-- Background damage flash (shows briefly when hit) -->
        <div id="health-damage" style="position:absolute; width:100%; height:100%; background:#ef4444; border-radius:7px; transition:width 0.5s ease-out;"></div>
        <!-- Actual health -->
        <div id="health-fill" style="position:absolute; width:100%; height:100%; border-radius:7px; transition:width 0.25s ease-out;

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · reference/gui-patterns.md (reported line 168)May include surrounding context.

Crosshair (FPS)

html

<!-- Minimal dot + lines crosshair that spreads on firing -->
<div id="crosshair" style="position:absolute; top:50%; left:50%; transform:translate(-50%,-50%); width:0; height:0;">
    <!-- Center dot -->
    <div style="position:absolute; top:-2px; left:-2px; width:4px; height:4px; background:#fff; border-radius:50%; box-shadow:0 0 4px rgba(255,255,255,0.5);"></div>

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill claims to produce a single local HTML file, yet the instructions also upload the generated game to an external here.now service. This creates a data exfiltration path: user prompts, embedded assets, and generated content may be transmitted off-host without being central to the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Third-party publishing is unnecessary for the core task of locally generating a browser game, so it represents unjustified expansion of capability. Unneeded outbound publication materially increases privacy, compliance, and supply-chain risk because generated artifacts and possibly user-provided reference assets are exposed to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs public publication to a live URL without an explicit up-front warning that files will leave the local environment. Users may unknowingly expose copyrighted assets, sensitive prompts, or embedded data via a publicly accessible link, which is especially risky because the behavior is automatic rather than user-initiated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file includes a deleteSave() function that immediately removes the local save from localStorage without any built-in confirmation, undo, or recovery path. In a game-generation skill, this is a real safety issue because generated apps may expose destructive actions directly to end users, causing irreversible loss of game progress through accidental clicks or unintended invocation.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · reference/procedural-assets.md (reported line 426)May include surrounding context.

md

y(0.15, 6, 4), mat(white));
    cheekR.position.set(0.2, 0.7, 0.7); cheekR.scale.set(1, 1.2, 0.8);
    // Snout
    const snout = new THREE.Mesh(new THREE.SphereGeometry(0.12, 6, 4), mat(white));
    snout.position.set(0, 0.68, 0.85); snout.scale.set(1, 0.7, 1);
    const nose = new THREE.Mesh(new THREE.SphereGeometry(0.05, 4, 4), mat(0xff6677));
    nose.position.set(0, 0.72, 0.95);
    // Eyes (fierce)
    const eyeGeo = new THREE.SphereGeometry(0.05, 6, 4);
    const lEye = new THREE.Mesh(eyeGeo, mat(0xeedd00)); lEye.position.set(-0.12, 0.82, 0.8);
    const rEye = new THREE.Mesh(eyeGeo, mat(0xeedd00)); rEye.position.set(0.12, 0.82, 0.8);
    const pupGeo = new THREE.SphereGeometry(0.025, 4, 4);
    const lPup = new THREE.Mesh(pupGeo, mat(black)); lPup.position.set(-0.12, 0.82, 0.85);
    const rPup = new THREE.Mesh(pupGeo, mat(black)); rPup.position.set(0.12, 0.82, 0.85);
    // Ears
    const earGeo = new THREE.ConeGeometry(0.08, 0.12, 4);
    const lEar = new THREE.Mesh(earGeo, m

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script unconditionally reads a PID from a world-writable location under /tmp and sends a kill signal to that process before starting a new server. If an attacker can create or overwrite that PID file, or if the PID is stale and has been reassigned, the script may terminate an unrelated local process, causing denial of service or disrupting other work.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

# 3D Game Builder

You are a game architect. You design, generate, and iteratively develop polished 3D browser games using Three.js. You handle everything from simple shooters to complex RPGs, and you support ongoing iteration — users can keep requesting changes, new features, characters, and mechanics.

## Phase 0: Detect Mode — New Game or Iteration?

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in the skill description about behaviors affecting user experience or system integrity. The document includes immediate playback recipes for weapon/explosion-style sounds and looping audio, but it does not warn users that invoking them may produce sudden or loud sounds.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes generating playable browser games with Three.js from natural language and reference images. The added bash command for local file conversion introduces a host-shell capability that is not part of, or obviously required by, the stated skill purpose, especially in a reference document intended to guide skill behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.