Who Is Undercover

• Outcome: Review
• Latest audit: May 28, 2026 · 11:05 AM UTC
• Version: 1.1.0

Overview

This looks like a real local multiplayer game, but it also ships under-disclosed helper code for an external game service with a hardcoded API key and scripts that can change or reveal game state.

Review before installing. The main game flow is bounded, but the package should remove and rotate the embedded InStreet key, clearly disclose or remove external-service helper code, make status scripts read-only or explicitly controlled, and restrict who can end multiplayer games.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file materially changes the skill from a self-contained local game into a thin client for a third-party service that can create rooms, join games, and submit moves remotely. This expands the trust boundary, introduces data flow to an external domain, and creates behavior not clearly disclosed by the manifest, which can mislead users and reviewers about where data and control are going.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The adapter performs authenticated requests with a bearer token to an external API, enabling remote room creation and gameplay actions. In a skill presented as a local social deduction game, this hidden network control path increases the risk of unauthorized external interactions, metadata leakage, and misuse of stored credentials.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The controller writes room identifiers, room URLs, and join API details to a local JSON file without any protection or minimization. If that file is readable by other local users, processes, logs, backups, or later exfiltrated, it could expose active room access details and enable unauthorized joining or interference.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: A hardcoded API key is embedded directly in source code, making credential exposure highly likely through source distribution, repository leaks, logs, screenshots, or package publication. Anyone obtaining the code can reuse the credential to access the external service, incur costs, manipulate rooms, or impersonate the application.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file is presented as a real-time status monitor, but it also mutates the authoritative game state by submitting AI descriptions, advancing the phase, and writing back to current_game.json. Mixing read-only monitoring with state-changing gameplay logic creates an integrity risk: any invocation intended only to observe status can unexpectedly alter the live game, which can be abused or trigger unintended game progression.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The misleading comment and apparent purpose of the script suggest it only monitors status, while the implementation performs active game actions. This kind of functionality mismatch is dangerous because operators, reviewers, or automation may run the script assuming it is safe and read-only, causing unintended state changes and reducing auditability.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code accepts and uses an API key for authenticated outbound requests without any visible disclosure, consent flow, or indication to users that their actions may invoke a third-party service. This is dangerous because secrets may be supplied under false assumptions about local-only behavior, and authenticated calls can create or manipulate external resources on the user's behalf.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The code not only hardcodes a sensitive credential but also provides no user disclosure or operational safeguards around how that secret is handled. In a user-facing skill, undisclosed embedded credentials increase the risk of silent third-party service use and make compromise harder to detect or govern.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The `handleEndGame` command allows any session currently mapped to the game to call `cleanupGame(gameId)` and terminate the shared multiplayer game for all participants, with no ownership check, role check, or confirmation step. In a multiplayer context this is a real authorization flaw and enables griefing or denial of service against other users' active sessions.

Static analysis

No suspicious patterns detected.