Security audit

游戏自动化-向僵尸开炮

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed game automation skill that controls the mouse and screenshots a named game window, with dependency and transparency caveats but no evidence of hidden exfiltration or destructive behavior.

Install only in a virtual environment, review or pin the Python dependencies, and run it only while the intended game window is open. Expect it to control your mouse, capture the game window to ./cache/shot.png, write local log files, and possibly take a moment to stop in Pro mode after Ctrl+Q.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill captures the game window and performs automated clicks without any user-facing notice, consent, or runtime confirmation. Even though this appears intended for game automation, silent screen capture and input injection can affect user trust, interfere with other activity if window targeting is wrong, and create abuse potential if repurposed or triggered unexpectedly.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The code writes logs to a timestamped file without informing the user what is being recorded or where it is stored. While the current log messages appear limited, undisclosed logging can still expose gameplay behavior, recognized text, or environment details and creates a transparency and privacy issue.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: These functions capture portions of an application window and persist the images to disk without any notice, consent flow, retention control, or access restriction. Even though the target appears to be a specific game window, screenshots can still contain user identifiers, chat, account data, or other sensitive on-screen information, and saving them to a predictable local path increases the chance of unintended disclosure.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pywin32 rapidocr onnxruntime pyautogui
Confidence: 96% confidence
Finding: The dependency list is unpinned, so installations may resolve to different versions over time, reducing build reproducibility and increasing supply-chain risk if a newly released or compromised version is pulled. This is more concerning here because the skill depends on Windows automation and input-control libraries, which typically run with broad local privileges and can amplify the impact of a malicious dependency update.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pywin32 rapidocr onnxruntime pyautogui loguru
Confidence: 95% confidence
Finding: Leaving rapidocr unpinned allows an unexpected package version to be installed, creating non-reproducible environments and exposing the project to supply-chain compromise or breaking changes. Because this skill appears to combine OCR with desktop automation, a compromised package could influence local processing and user interaction flows.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pywin32 rapidocr onnxruntime pyautogui loguru keyboard
Confidence: 95% confidence
Finding: An unpinned onnxruntime dependency permits uncontrolled version drift, which can introduce vulnerable or malicious releases into the environment. In a skill using local model/runtime components, this increases attack surface through native code and model-execution libraries.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pywin32 rapidocr onnxruntime pyautogui loguru keyboard # pip install paddlepaddle-gpu==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cu118/
Confidence: 97% confidence
Finding: Unpinned pyautogui is risky because any future install may fetch an unintended version, including one with malicious behavior or newly introduced vulnerabilities. This is especially dangerous in this skill context because pyautogui can control mouse and keyboard input, so a compromised package could directly manipulate the host system.

Unpinned Dependencies

Low

Category: Supply Chain
Content: rapidocr onnxruntime pyautogui loguru keyboard # pip install paddlepaddle-gpu==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cu118/ # paddlepaddle-gpu==3.0.0
Confidence: 94% confidence
Finding: The loguru dependency is unpinned, which enables version drift and raises supply-chain risk. In addition, this package has advisory history, so failing to pin and deliberately choose a safe version makes it easier to install an unsafe release.

Unpinned Dependencies

Low

Category: Supply Chain
Content: onnxruntime pyautogui loguru keyboard # pip install paddlepaddle-gpu==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cu118/ # paddlepaddle-gpu==3.0.0 # rapidocr_paddle
Confidence: 97% confidence
Finding: The keyboard package is unpinned, allowing installation of arbitrary future versions and increasing supply-chain exposure. In this context, that is particularly sensitive because keyboard libraries can intercept or synthesize keystrokes, so compromise could lead to credential capture or unauthorized command execution on the local machine.

Known Vulnerable Dependency: pywin32 — 2 advisory(ies): CVE-2021-32559 (Integer overflow in pywin32); CVE-2021-32559 (An integer overflow exists in pywin32 prior to version b301 when adding an acces)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: The requirements file includes pywin32 without constraining it to a patched version, and the static analysis indicates known advisories affecting older releases. Since pywin32 exposes Windows API functionality, a vulnerable version can materially increase risk on the host, especially in an automation-oriented skill that may already have elevated local access.

Known Vulnerable Dependency: loguru — 2 advisory(ies): CVE-2022-0338 (loguru logs sensitive information); CVE-2022-0338 (Improper Privilege Management in Conda loguru prior to 0.5.3.)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: The file includes loguru and does not pin it to a safe version, while the scanner reports known advisories for older releases. Even if advisory metadata for loguru can sometimes be ecosystem-specific or noisy, the dependency should still be treated as a real risk until the version is constrained to a verified fixed release.

Static analysis

No suspicious patterns detected.