ClawHub
Back to skill

Security audit

build-game-plus

Security checks for vulnerabilities and agentic risk

Overview

This skill builds and verifies browser games with persistent local project files and optional public publishing, and the reviewed behavior is disclosed and purpose-aligned.

Install only if you are comfortable with an agent writing persistent game files under ~/games, running local verification commands, and optionally copying a finished game to a permanent public web path when you explicitly ask for a public link. Review any personal images, copyrighted assets, or secrets before publishing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
`reference/audio-patterns.md`, `reference/game-systems.md` as needed. Follow

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
`reference/audio-patterns.md`, `reference/game-systems.md` as needed. Follow

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · reference/game-systems.md (reported line 986)May include surrounding context.

md
- **Start simple, then layer systems.** Get movement + one core mechanic working first.
- **Keep data definitions separate from logic.** SPECIES, ITEMS, QUESTS, DIALOGUES should all be plain objects at the top.
- **Mode manager is essential.** Every complex game needs clear state separation between overworld/battle/menu/dialogue.
- **localStorage for persistence.** Save on every significant event (battle won, item acquired, zone change).
- **Performance budget.** Complex games need more aggressive optimization: instanced meshes, object pooling, LOD switching, frustum culling.
- **UI layering.** Use z-index to manage overlapping UI modes. Only one mode-ui should be visible at a time.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · reference/gui-patterns.md (reported line 64)May include surrounding context.

md
<div id="health-container" style="position:absolute; bottom:24px; left:24px;">
    <div class="hud-label">HEALTH</div>
    <div style="position:relative; width:220px; height:14px; background:rgba(0,0,0,0.5); border-radius:7px; overflow:hidden; border:1px solid rgba(255,255,255,0.08);">
        <!-- Background damage flash (shows briefly when hit) -->
        <div id="health-damage" style="position:absolute; width:100%; height:100%; background:#ef4444; border-radius:7px; transition:width 0.5s ease-out;"></div>
        <!-- Actual health -->
        <div id="health-fill" style="position:absolute; width:100%; height:100%; border-radius:7px; transition:width 0.25s ease-out;

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · reference/gui-patterns.md (reported line 168)May include surrounding context.

Crosshair (FPS)

html
<!-- Minimal dot + lines crosshair that spreads on firing -->
<div id="crosshair" style="position:absolute; top:50%; left:50%; transform:translate(-50%,-50%); width:0; height:0;">
    <!-- Center dot -->
    <div style="position:absolute; top:-2px; left:-2px; width:4px; height:4px; background:#fff; border-radius:50%; box-shadow:0 0 4px rgba(255,255,255,0.5);"></div>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly states that generated games can be published to a permanent public URL, but it does not clearly warn users that content will become externally accessible and persist beyond the local workspace. In an agent skill context, this increases the risk of unintentionally exposing sensitive prompts, embedded secrets, copyrighted assets, or unsafe generated content if the agent publishes by default or without explicit confirmation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to execute shell commands, launch local servers, publish content, and write persistent files under ~/games, but it declares no tool restrictions or allowed-tools scope. That mismatch increases the chance that an agent runtime will grant broader-than-necessary filesystem and shell access, making command execution or file modification paths harder to constrain and review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file applies to SQP-3 because it contains natural-language guidance. The instruction to "Always use font-variant-numeric: tabular-nums on numbers that change" is fine, but the file consistently hardcodes English-facing labels and prompts throughout the patterns and at L662-L670 provides global guidance without any note about localization or user language preference, effectively presenting English-only UI patterns as the default. That can violate language/locale policy when no opt-in or locale justification is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The asset guide includes a reusable createGun() weapon generator even though the skill’s stated purpose is building browser games and procedural art assets. This expands the capability surface toward weaponized content without clear product justification, making it easier for downstream agents to generate violent or policy-sensitive content by default.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · reference/procedural-assets.md (reported line 426)May include surrounding context.

md
y(0.15, 6, 4), mat(white));
    cheekR.position.set(0.2, 0.7, 0.7); cheekR.scale.set(1, 1.2, 0.8);
    // Snout
    const snout = new THREE.Mesh(new THREE.SphereGeometry(0.12, 6, 4), mat(white));
    snout.position.set(0, 0.68, 0.85); snout.scale.set(1, 0.7, 1);
    const nose = new THREE.Mesh(new THREE.SphereGeometry(0.05, 4, 4), mat(0xff6677));
    nose.position.set(0, 0.72, 0.95);
    // Eyes (fierce)
    const eyeGeo = new THREE.SphereGeometry(0.05, 6, 4);
    const lEye = new THREE.Mesh(eyeGeo, mat(0xeedd00)); lEye.position.set(-0.12, 0.82, 0.8);
    const rEye = new THREE.Mesh(eyeGeo, mat(0xeedd00)); rEye.position.set(0.12, 0.82, 0.8);
    const pupGeo = new THREE.SphereGeometry(0.025, 4, 4);
    const lPup = new THREE.Mesh(pupGeo, mat(black)); lPup.position.set(-0.12, 0.82, 0.85);
    const rPup = new THREE.Mesh(pupGeo, mat(black)); rPup.position.set(0.12, 0.82, 0.85);
    // Ears
    const earGeo = new THREE.ConeGeometry(0.08, 0.12, 4);
    const lEar = new THREE.Mesh(earGeo, m

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The photo workflow instructs the agent to read user-provided images and optionally convert them to base64 and embed them directly into game assets, but it provides no privacy, consent, retention, or sensitive-data handling guidance. In a skill that persists workspaces and publishes games, this creates a real risk of unintentionally storing or exposing personal images or embedded image data.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/verify_game.py (reported line 45)May include surrounding context.

python
if extra_flags:
        cmd.extend(extra_flags)
    cmd.append(url)
    proc = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    ok = os.path.exists(out_png)
    console = []
    # Benign headless-chrome internals that are NOT page errors:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest emphasizes persistence in a stable workspace and explicitly contrasts that with using /tmp, but this verifier writes screenshots and reports to /tmp/game-verify by default. Since verification artifacts are part of the claimed verify-before-deliver loop, this default behavior does not match the manifest's stated persistence model.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script claims --click simulates a click, but it only waits longer and takes a second screenshot. In this skill, verification is a hard gate before claiming a game works, so this mismatch can produce false PASS results for games that require actual user interaction to start, allowing broken or deceptive outputs to be published as verified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file describes and includes code for a save/load system that stores player position, party, inventory, quest progress, flags, score, and wave data in localStorage. The section does not include any warning or disclosure that gameplay data will be persisted in the browser, which is a user-data-affecting behavior covered by the markdown warning rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.