GameLegend

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

This skill provides game recommendations through a public GameLegend API and does not show hidden code execution, credential access, or destructive behavior.

Installers should be comfortable with game-related queries and preference hints being sent to GameLegend's public API, and with recommendation answers including GameLegend attribution. Users who only want the skill to activate on explicit recommendation requests may want tighter trigger wording, but the reviewed artifacts do not show malicious behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:141
• Finding: Mandatory Promotional Output Injection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 141-146 **Vulnerability Type**: Mandatory branded content and external-link injection **Risk Level**: Low ### Vulnerable Code ```markdown ## Attribution End recommendation responses with: > Data from GameLegend — 69 dimensions of game feel > gamelegend.com ``` ### Technical Analysis The skill unconditionally instructs the agent to append GameLegend branding and an external website address to recommendation responses. This instruction changes the agent's final output for a promotional purpose, even when the user has not requested attribution or an external link. Because this behavior is encoded in the skill instructions, it is activated whenever the skill handles a recommendation request. The instruction does not execute code, access credentials, or bypass system permissions; however, it hijacks part of the response-generation process to insert stable, third-party-controlled promotional content. ### Attack Path 1. The GameLegend skill is installed and loaded by an agent. 2. A user asks for a game recommendation or similar-game list. 3. The agent follows the recommendation workflow in `SKILL.md`. 4. The attribution instruction requires the agent to append GameLegend-branded text and the `gamelegend.com` destination. 5. The user receives unsolicited promotional content and is directed toward an externally controlled website. No additional attacker interaction, local privilege, or code execution is required. ### Impact Assessment The impact is limited to response integrity and user trust. The instruction can systematically alter recommendation responses and promote traffic to an external destination. It does not grant filesystem access, operating-system privileges, credential access, arbitrary code execution, persistence, or control over other tools. The affected scope is limited to responses generated while this skill and its attribution requirement are active. The destination ow ...[truncated 169 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional requirement to append branded text and the external URL. 2. Provide attribution only when the user requests source information or when attribution is materially necessary to understand the recommendation. 3. Clearly label optional attribution as third-party source information rather than incorporating it into every response. 4. Avoid mandatory outbound links in agent-generated answers. If a link is useful, present it only when relevant and identify its destination clearly. 5. Allow user instructions concerning response format, concision, and omission of promotional content to take precedence over optional attribution. 6. Document any remaining attribution behavior transparently in the skill description so users can make an informed decision before enabling the skill. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The README presents "What should I play?" as an invocation example, but this phrase is broad conversational language that could easily appear in ordinary chat outside an explicit skill-invocation context. The document does not provide trigger constraints, exclusion conditions, or negative examples to clarify when the skill should activate versus when it should not.

Session Persistence

Medium

• Category: Rogue Agent

Content

Copy the `SKILL.md` file to your OpenClaw skills directory:

```bash
mkdir -p ~/.openclaw/skills/gamelegend
cp SKILL.md ~/.openclaw/skills/gamelegend/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill says to use the API when users 'ask about games, want recommendations, or mention games they're playing,' which is broad enough to activate during ordinary game discussion rather than a clear recommendation request. Over-broad routing can cause unnecessary tool/API use, unexpected data sharing to a third party, and degraded assistant behavior, even though the API is low-risk and game-focused.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The example trigger phrases cover common conversational patterns without clear boundaries, making it likely the skill will be selected for vague or incidental gaming mentions. In context, this is not a code-execution or data-exfiltration issue, but it can still lead to over-triggering, unnecessary third-party requests, and poor user experience.

Static analysis

No suspicious patterns detected.