Game Scout

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:37 AM UTC
• Version: 0.3.1

Overview

The skill does what it says: researches game advice online, but users should know it sends queries and URLs to third-party services.

Install this only if you are comfortable sending game-related searches, URLs, Reddit/Twitter/X targets, and YouTube targets to Exa, Bright Data, and yt-dlp-backed retrieval. Avoid using it with private, internal, authenticated, or sensitive URLs, and keep the required API keys scoped and revocable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is a video game strategy/meta assistant triggered by gaming-related questions. However, the supplied code does not analyze games, builds, strategies, patch notes, or synthesize knowledge from gaming sources. Its sole behavior is to call yt-dlp on a provided YouTube URL, retrieve metadata and subtitles, clean subtitle formatting, and output the resulting transcript text. That is a materially different primary purpose and introduces undeclared capabilities related to YouTube transcript extraction. While YouTube could be one source for gaming knowledge, this code by itself is just a transcript-fetching tool, not a game strategy specialist.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger includes 'any question mentioning a video game by name,' which is so broad that the skill may activate for casual or irrelevant mentions and begin external research unnecessarily. In a skill with scraping, network access, and social-media retrieval, over-triggering increases the chance of unneeded third-party data access, privacy leakage of user prompts, and unexpected tool execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger scope is extremely broad (e.g., any question mentioning a video game by name), which can cause the skill to activate on many unrelated prompts and pull in external web-sourced content unexpectedly. While not directly exploitable as code execution, over-broad invocation increases the chance of unnecessary data sharing to third-party services and unintended agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to configure Exa AI and Bright Data and to use yt-dlp, but it does not warn that user queries and fetched targets may be transmitted to external services. In this skill's context, broad web aggregation across Reddit, YouTube, wikis, Twitter/X, and third-party scraping/search providers makes silent external transmission materially more risky from a privacy and compliance perspective.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes networked scripts, reads reference files, uses shell commands, and relies on environment-backed API credentials, but it does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization ambiguity where an agent may grant broader capabilities than users expect, increasing the risk of unintended web access, scraping, or credential-backed requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description does not clearly warn users that it performs third-party scraping and retrieves content from Reddit, Twitter/X, YouTube, and other sites using external services. This weakens informed consent and transparency, making it easier for user queries to be sent to outside providers unexpectedly, including potentially sensitive gaming account names, preferences, or private context embedded in prompts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bright-scrape.mjs (reported line 43)May include surrounding context.

js

};
  if (country) body.country = country;

  const resp = await fetch("https://api.brightdata.com/request", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bright-scrape.mjs (reported line 43)May include surrounding context.

js

};
  if (country) body.country = country;

  const resp = await fetch("https://api.brightdata.com/request", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bright-twitter.mjs (reported line 65)May include surrounding context.

js

};
  if (country) body.country = country;

  const resp = await fetch("https://api.brightdata.com/request", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bright-twitter.mjs (reported line 82)May include surrounding context.

js

};
  if (country) body.country = country;

  const resp = await fetch("https://api.brightdata.com/request", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bright-twitter.mjs (reported line 88)May include surrounding context.

js

};
  if (country) body.country = country;

  const resp = await fetch("https://api.brightdata.com/request", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script provides a general-purpose Twitter/X scraping capability that is not constrained to video-game-related content, despite the skill being described as a game-strategy specialist. That broader collection ability increases the chance the skill can be repurposed to gather arbitrary social-media content, expanding data-collection scope beyond user expectations and stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script transmits user-supplied URLs to Bright Data, a third-party scraping provider, without any user-facing disclosure or consent mechanism. Even if the URLs are public tweets, sending them and associated query activity to an external processor creates privacy, compliance, and expectation risks, especially in an agent skill context where users may not realize a third party is involved.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This network call sends authenticated requests and user-provided tweet URLs to an external service. External transmission is not inherently malicious, but here it matters because the skill silently relies on a third-party scraper, creating data-sharing and governance risk beyond the skill's stated narrow purpose.

Content

Scanner excerpt · scripts/bright-twitter.mjs (reported line 39)May include surrounding context.

js

// Step 1: Trigger async collection
const triggerResp = await fetch(
  `https://api.brightdata.com/datasets/v3/trigger?dataset_id=${datasetId}&notify=false&include_errors=true`,
  {
    method: "POST",
    headers,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/exa-contents.mjs (reported line 40)May include surrounding context.

js

body.summary = { query: summaryQuery };
}

const resp = await fetch("https://api.exa.ai/contents", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": apiKey },
  body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/exa-contents.mjs (reported line 40)May include surrounding context.

js

body.summary = { query: summaryQuery };
}

const resp = await fetch("https://api.exa.ai/contents", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": apiKey },
  body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/exa-search.mjs (reported line 58)May include surrounding context.

js

body.summary = { query: summaryQuery };
}

const resp = await fetch("https://api.exa.ai/contents", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": apiKey },
  body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/exa-search.mjs (reported line 58)May include surrounding context.

js

if (includeSummary) body.contents.summary = { query };
}

const resp = await fetch("https://api.exa.ai/search", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": apiKey },
  body: JSON.stringify(body),

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a video game strategy skill that aggregates gaming information sources, but this file implements a standalone similarity-search client that depends on a separately provisioned EXA credential. Accessing environment-stored API secrets is a capability beyond the user-facing gaming-specialist purpose and is not justified by the manifest text provided.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This fetch call sends request data to api.exa.ai, creating an external data egress path from the skill. Because the payload includes a user-controlled URL and can include page-content-related parameters, the script can disclose sensitive browsing targets or derived content to a third party without any visible safety controls or notice.

Content

Scanner excerpt · scripts/exa-similar.mjs (reported line 38)May include surrounding context.

js

if (startDate) body.startPublishedDate = `${startDate}T00:00:00.000Z`;
if (includeContents) body.contents = { text: { maxCharacters: 5000, verbosity: "compact" } };

const resp = await fetch("https://api.exa.ai/findSimilar", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": apiKey },
  body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This fetch call sends request data to api.exa.ai, creating an external data egress path from the skill. Because the payload includes a user-controlled URL and can include page-content-related parameters, the script can disclose sensitive browsing targets or derived content to a third party without any visible safety controls or notice.

Content

Scanner excerpt · scripts/exa-similar.mjs (reported line 38)May include surrounding context.

js

if (startDate) body.startPublishedDate = `${startDate}T00:00:00.000Z`;
if (includeContents) body.contents = { text: { maxCharacters: 5000, verbosity: "compact" } };

const resp = await fetch("https://api.exa.ai/findSimilar", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": apiKey },
  body: JSON.stringify(body),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script transmits a user-supplied URL, optional domain filters, date filters, and potentially fetched page text metadata to a third-party API without any consent, disclosure, or trust boundary checks. In an agent skill context, this can leak sensitive user-provided links or private/internal targets to an external provider, which is especially concerning because a game-scout skill would not obviously need undeclared third-party URL sharing.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/yt-transcript.py (reported line 45)May include surrounding context.

python

url,
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, check=True, text=True)
        import json

        data = json.loads(result.stdout)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The command hard-codes --sub-lang en, which imposes an English-only locale choice in the skill behavior. There is no user opt-in, parameter, or documented justification that this is a region- or language-specific tool, so it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/yt-transcript.py (reported line 96)May include surrounding context.

python

]

        try:
            subprocess.run(cmd, cwd=temp_dir, check=True, capture_output=True)
        except subprocess.CalledProcessError as e:
            print(
                f"Error running yt-dlp: {e.stderr.decode()}", file=sys.stderr

Static analysis

No suspicious patterns detected.