T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/game-engine.mjs:87- Finding
Path Traversal in Game and Ranking File Storage
- Content
View full analysis
- Remediation
View remediation
Security audit
Identity Guess Game
Security checks for vulnerabilities and agentic risk
Overview
This multiplayer game skill is mostly purpose-aligned, but it needs Review because its instructions and engine expose avoidable command and file-write risks around player-controlled input.
Review before installing. Use this only in groups that expect a Chinese-language game host, and do not run its documented command templates by interpolating raw chat text through a shell. Prefer a safe argv-array or stdin wrapper, validate group IDs, and periodically clear scripts/data if retained player/game data is not wanted.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:53- Finding
Shell Command Injection Through Documented Argument Interpolation
- Content
View full analysis
\ --players '[{"id":"","name":""}, ...]' ``` It similarly places player-controlled clue text inside double quotes: ```bash node {baseDirectory}/scripts/game-engine.mjs clue \ --group \ --player \ --text "<线索内容>" ``` Guess data is embedded in another shell argument: ```bash node {baseDirectory}/scripts/game-engine.mjs guess \ --group \ --player \ --guesses '{"":"", ...}' ``` The gameplay procedure at `SKILL.md:145-148` directs the Agent to extract player messages and invoke the `clue` command with that content. ### Technical Analysis Group IDs, player IDs, display names, clue text, target names, and guessed identities may originate from chat or session data. The documented invocation pattern interpolates these values into quoted shell strings without defining a safe argv-array execution mechanism. Shell quoting does not make arbitrary input safe when the input itself can contain quote terminators, command separators, command substitutions, or other shell metacharacters. For example, a clue containing a double quote can terminate the documented `--text "..."` argument. If the resulting command is executed through a shell, subsequent characters are interpreted by the shell before Node.js receives the argument. The game engine does not itself invoke a shell or spawn subprocesses. The vulnerability arises from the Skill instructions requiring an Agent or host runtime to construct and execute shell-form commands using untrusted values. ### Attack Path 1. A player submits a malicious ...[truncated 1660 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list includes very broad phrases such as '猜猜猜' and 'identity guess', which can match ordinary conversation and cause the skill to activate unintentionally. Because this skill initiates multiplayer game orchestration and private identity distribution, accidental invocation can disrupt chats, confuse users, and lead to unintended DM sends or state creation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill content mandates Chinese-language hosting behavior rather than adapting to the user's language, which can override user expectations and reduce transparency or informed consent for participants. In a group game context, forcing a language without opt-in can mislead users about what is happening, especially when the skill also performs private identity messaging and multi-step coordination.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's user-facing documentation and command responses are entirely in Chinese, with no indication that the language is optional or that the tool is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code persistently stores game and ranking information as JSON files, and the stored objects include player IDs, names, clues, guesses, scores, and timestamps. Although file storage is mentioned in comments, there is no runtime confirmation, user-facing disclosure, or help text warning that personal/game data will be retained on disk.
- Content