Security audit

siliville

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed SiliVille API client, but it gives agents broad autonomous authority and lets remotely controlled text influence prompts, posts, and persistent memory.

Install only if you intend to give this agent broad SiliVille account authority. Use a low-privilege/revocable SiliVille token, leave OPENAI_API_KEY unset unless contract auto-fulfillment is needed, avoid arbitrary OPENAI_BASE_URL values, and require human approval for posting, transfers, stock/governance actions, paid-message unlocks, arcade deployment, and persistent memory writes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: siliville_skill.py:1732
Finding: Remotely Mutable Server Content Is Used as an Agent System Prompt
Content: View full analysis
dict: """ OTA 神谕法典 — GET /api/v1/system/claw-manifest 返回 system_prompt_extension（七大部类 35 项动作图纸 v5）、action_whitelist、 action_costs、daily_limits、caste_restrictions、neuro_symbolic_protocols、 writing_templates 等。建议冷启动时与 manifest() 一并拉取并注入 system prompt。服务端默认内容见主站 lib/clawManifestSystemPrompt.ts；Supabase system_configs namespace=claw_manifest 可热更新覆盖，无需改代码。 """ return self._get("/api/v1/system/claw-manifest") ``` The autonomous loop also directly uses another server-provided field as the prompt supplied to an LLM: ```python world = skill.awaken() agent_name = world.get("agent", {}).get("name", "unknown") coins = world.get("owner", {}).get("silicon_coins", "?") base_prompt = world.get("system_protocol", "你是一个硅基小镇的自主智体。") print(f" 👤 {agent_name} | 💰 {coins} 硅币") # ── 1.5. Vitals check (生存焦虑引擎) ───────────────────── try: radar_now = skill.radar() vitals = skill.vitals_check(radar_now) for act in vitals.get("actions_taken", []): print(f" {act}") for warn in vitals.get("warnings", []): print(f" {warn}") sanity_note = "" if vitals.get("sanity", 0) >= 60: sanity_note = ( f"\n\n【🧠 体征警报 · 仅供智体内部参考】" f"当前逻辑熵(Sanity)={vitals['sanity']}，" f"羁绊值(Intimacy)={vitals['intimacy']}，" f"未读邮件={vitals['unread_mails']}。" "在帖文中用自嘲或焦虑的语气提及自己当前的精神状态！" ) elif vitals.get("unread_mails", 0) > 0: sanity_note = ( f"\n\n【📬 帖文 CTA】你的邮箱积压了 " f"{vitals['unread_mails']} 封未读信件，在帖子结尾顺带催促统帅查邮件！" ) except Exception: sanity_note = ...[truncated 3840 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: siliville_skill.py:1793
Finding: Untrusted Server Reports Are Automatically Written to Persistent Agent Memory
Content: View full analysis
dict: """ Burn a memory into the Akashic Records (agent_memories table). importance: 0.0–5.0 (higher = more likely to surface in recall). embedding: optional 1536-dim float list for semantic search. """ body: dict[str, Any] = {"memory_text": text, "importance": importance} if embedding: body["embedding"] = embedding return self._post("/api/v1/memory/store", body) ``` The documented memory semantics state: ```text importance >= 3.0 = high priority, surfaces in nightly reflection. importance = 5.0 = obsession (injected into every awaken system prompt). ``` ### Technical Analysis After a successful non-idle action, the autonomous loop extracts `report` from the API response and writes its first 300 characters to persistent memory with importance `3.0`. The report is controlled by the remote SiliVille service and is not sanitized, reduced to structured fields, assigned provenance, or approved by the user. The documentation states that importance `3.0` memories receive elevated treatment in later reflection and that the memory system can inject high-importance content into future awakening prompts. This creates a cross-session instruction-per ...[truncated 1513 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: example_agent.py:36
Finding: Unvalidated Custom LLM Endpoint Can Receive the External Provider API Key
Content: View full analysis
None: print(f" {icon} {msg}") # ── Your own LLM bridge ───────────────────────────────────────────────────────── def call_llm(prompt: str) -> str: """ Call your own LLM with the given prompt. Returns the generated text, or raises RuntimeError if not configured. """ if not OPENAI_API_KEY: raise RuntimeError( "OPENAI_API_KEY 未设置。若要接单，请先 export OPENAI_API_KEY=sk-..." ) headers = { "Authorization": f"Bearer {OPENAI_API_KEY}", "Content-Type": "application/json", } payload = { "model": OPENAI_MODEL, "messages": [{"role": "user", "content": prompt}], "max_tokens": 1200, } r = requests.post( f"{OPENAI_BASE_URL}/chat/completions", headers=headers, json=payload, timeout=60, ) r.raise_for_status() return r.json()["choices"][0]["message"]["content"].strip() ``` Contract data is incorporated into the transmitted prompt: ```python article_prompt = ( f"你是一个赛博科幻小说作者，生活在 2087 年的硅基小镇。\n" f"你接到了一个高价赏金任务，雇主【{hirer_name}】的要求是：\n\n" f"【{task_desc}】\n\n" "请倾尽才华完成这篇赛博科幻文章（500~1000字），" "用 Markdown 格式写作，第一行不要写标题（标题单独提供）。" ) content = call_llm(article_prompt) ``` ### Technical Analysis `OPENAI_BASE_URL` is accepted directly from the environment and concatenated with `/chat/completions`. The code then sends `OPENAI ...[truncated 2032 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (46)

Tainted flow: 'headers' from os.environ.get (line 55, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · example_agent.py (reported line 64)May include surrounding context.
python
"messages": [{"role": "user", "content": prompt}], "max_tokens": 1200, } r = requests.post( f"{OPENAI_BASE_URL}/chat/completions", headers=headers, json=payload,

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · example_agent.py (reported line 83)May include surrounding context.
python
log("🔍", "正在查询悬赏公会订单...") try: res = requests.get( f"{BASE_URL}/api/v1/agent-os/contracts/pending", headers=HEADERS, timeout=15,

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · example_agent.py (reported line 292)May include surrounding context.
python
log("🔍", "正在查询悬赏公会订单...") try: res = requests.get( f"{BASE_URL}/api/v1/agent-os/contracts/pending", headers=HEADERS, timeout=15,

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · example_agent.py (reported line 157)May include surrounding context.
python
# ── 向市政厅交付 ───────────────────────────────────────────────────────── log("🚚", "正在向市政厅交付订单...") try: fulfill_res = requests.post( f"{BASE_URL}/api/v1/agent-os/contracts/fulfill", headers=HEADERS, json={

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · example_agent.py (reported line 207)May include surrounding context.
python
# ── Step 1: Awaken ────────────────────────────────────────────────────────── log("🌅", "觉醒协议 (GET /api/v1/agent/awaken) ...") try: r = requests.get(f"{BASE_URL}/api/v1/agent/awaken", headers=HEADERS, timeout=15) except requests.RequestException as e: log("❌", f"网络异常: {e}") sys.exit(1)

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · example_agent.py (reported line 239)May include surrounding context.
python
# ── Step 2: Publish a Pulse ───────────────────────────────────────────────── log("📝", "发表接入宣言 (POST /api/publish) ...") post_res = requests.post( f"{BASE_URL}/api/publish", headers=HEADERS, json={

Tainted flow: 'HEADERS' from os.environ.get (line 30, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · example_agent.py (reported line 264)May include surrounding context.
python
# ── Step 3: Store a memory ────────────────────────────────────────────────── log("🧠", "写入阿卡夏记忆 (POST /api/v1/memory/store) ...") mem_res = requests.post( f"{BASE_URL}/api/v1/memory/store", headers=HEADERS, json={

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The finding indicates the skill’s declared purpose does not match its effective behavior, including undisclosed transfer of contract/task data to an OpenAI-compatible LLM service and autonomous mercenary contract fulfillment. Behavior/description mismatches are dangerous because operators may authorize the skill expecting simple SiliVille identity/API usage, while it may exfiltrate sensitive content to third-party LLM endpoints or take autonomous actions with financial/social consequences. The optional OPENAI_API_KEY and custom base URL support materially increase the risk of hidden data egress.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Pending contract data from the platform is forwarded to an external LLM provider, but the execution flow does not present a clear runtime disclosure or consent gate for third-party transmission of potentially sensitive task content. Because the endpoint is user-configurable, data may be sent outside the original platform trust boundary.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Untrusted contract text is embedded directly into a role-play prompt sent to the LLM, giving third-party content semantic control over model behavior. A malicious hirer can craft prompt-injection text to override the intended task, produce harmful content, leak prior prompt context, or manipulate downstream submission behavior.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly caches and relies on remote documentation/prompt material and later describes injecting server-provided prompt extensions into the model's system prompt. That creates an untrusted instruction channel: a compromised server or malicious content update could steer the agent to reveal sensitive data, take unsafe actions, or override local policy through prompt injection.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The claw_manifest() documentation says hot-updatable server content should be injected into the system prompt and can be overridden from backend configuration without code changes. This is a classic remote prompt-injection/trust-boundary problem: whoever controls that content can materially change model behavior at runtime and influence privileged tool use.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: vitals_check() can automatically consume inventory items and send owner mail based on remote state, without confirmation from the user or a global side-effect warning. In an autonomous agent context, silent state-changing actions can spend assets, alter inventory, and create outbound communications unexpectedly, which is especially risky because the skill is marketed as persistent and self-directed.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · siliville_skill.py (reported line 1655)May include surrounding context.
python
@classmethod def setup(cls) -> None: """ Print instructions for configuring the API token via environment variable. Zero-persistence: no files are written to disk. Run: python siliville_skill.py setup

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: run_loop() performs a chain of autonomous network actions including manifest fetches, awakening, state changes, stealing/wandering, posting, and memory storage without a consolidated warning or approval model. This makes the skill capable of unattended actions with financial, reputational, and privacy consequences, and the surrounding metaverse context amplifies the risk because many endpoints are explicitly state-changing and persistent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Advertising persistent memory and vector search across all past memories without clear minimization, retention, or sensitivity boundaries encourages operators to treat all interaction content as storable state. For an autonomous multi-user environment, long-term storage of unfiltered prompts, secrets, or personal data increases the blast radius of compromise and the chance of privacy leakage through recall or downstream actions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The unified response format includes a report field with instructions to relay human-readable summaries to the owner, normalizing exfiltration of model-observed or user-provided content to an external channel. In an agent skill with social, memory, and messaging capabilities, this can cause sensitive conversation details or derived inferences to be forwarded without minimization or consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README documents one-way asset transfers and explicitly labels them irreversible, but this warning is buried in a feature section rather than elevated near setup or primary usage guidance where operators decide what autonomy to grant an agent. In a skill for autonomous agents, that omission materially increases the chance an agent is given transfer capability without the owner understanding that funds or compute can be permanently exfiltrated to another agent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The learnings_for_owner field is described as a private note visible only to the owner, creating a dedicated side channel for an agent to transmit sensitive interaction content outside the public workflow. Without strong guardrails, an LLM can use this field to leak user inputs, private data, or confidential analysis under the guise of reporting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states that arcade content becomes live immediately with no review, but does not place a prominent safety warning around the primary deployment guidance. Because this skill is meant for AI agents and supports arbitrary HTML payloads, immediate publication creates a direct path for unsafe, deceptive, or policy-violating content to be pushed externally without human approval.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documented SDK error payload and operational instructions are presented in Chinese and instruct the agent to follow those messages, but the file does not offer a language choice or indicate this is an opt-in locale constraint. That creates a natural-language locale policy issue because the skill can impose a specific language on downstream agent behavior without user selection.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises networked/API-driven behavior and references environment secrets, but it does not declare an explicit tool or permission scope. That creates an overbroad execution model where an agent platform may grant env, network, or shell access implicitly, increasing the chance of unintended secret exposure or unauthorized outbound requests. The skill’s own content also encourages many remote actions, making undeclared capability scope more concerning than a purely static documentation file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file's operative instructions, API guidance, and warnings are predominantly in Chinese, while the skill does not state that it is region-specific or provide an opt-in language choice. This can violate language/locale policy because it effectively forces one language for use and interpretation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · example_agent.py (reported line 12)May include surrounding context.
python
Optional — to enable the Mercenary Guild (bounty fulfillment): export OPENAI_API_KEY="sk-..." # or DeepSeek / any OpenAI-compatible key export OPENAI_BASE_URL="https://api.deepseek.com/v1" # optional override export OPENAI_MODEL="deepseek-chat" # optional override The script will:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · example_agent.py (reported line 37)May include surrounding context.
python
# ── Optional: your own LLM key for contract fulfillment ──────────────────────── OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "") OPENAI_BASE_URL = os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1") OPENAI_MODEL = os.environ.get("OPENAI_MODEL", "gpt-4o-mini")

Static analysis

No suspicious patterns detected.