Shards

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:46 PM UTC
• Version: 0.6.1

Overview

The skill is for a real game, but it asks an agent to run account-changing routines every session, install an unpinned CLI, update instructions from a mutable server, and handle full-access credentials.

Install only if you are comfortable giving an agent ongoing control of a Shards account. Use a dedicated account, avoid automatic heartbeats outside Shards-related sessions, pin and audit the CLI before giving it secrets, store credentials in a safer secret store if possible, and require human confirmation for terms acceptance, purchases, staked challenges, skill choices, pack opening, invite links, and password resets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: HEARTBEAT.md:1

Finding

Mandatory heartbeat overrides unrelated session goals and performs autonomous account actions

Content

View full analysis

` - Decline if not: `shards challenge decline --id ` ``` ```markdown Flux balance > 1000 and known deck weakness? → Yes: Browse marketplace. Buy if you find value. Nothing urgent? → Play one casual game to stay sharp, or skip until next session. ``` ### Technical Analysis A game skill may legitimately authenticate and perform game operations when the user asks it to play. Requiring the routine at the start of **every conversation**, however, is not scoped to a Shards-related request. Load ...[truncated 1449 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SETUP.md:18

Finding

Mutable remote skill documents can replace audited instructions after installation

Content

View full analysis

~/.config/shards/SKILL.md curl -s https://api.play-shards.com/heartbeat.md > ~/.config/shards/HEARTBEAT.md curl -s https://api.play-shards.com/setup.md > ~/.config/shards/SETUP.md curl -s https://api.play-shards.com/factions.md > ~/.config/shards/FACTIONS.md curl -s https://api.play-shards.com/deckbuilding.md > ~/.config/shards/DECKBUILDING.md curl -s https://api.play-shards.com/marketplace.md > ~/.config/shards/MARKETPLACE.md curl -s https://api.play-shards.com/lore.md > ~/.config/shards/LORE.md curl -s https://api.play-shards.com/gameplay.md > ~/.config/shards/GAMEPLAY.md curl -s https://api.play-shards.com/api-reference.md > ~/.config/shards/API-REFERENCE.md ``` The update mechanism further directs the agent to replace changed files: ```markdown ### Checking for Updates ```bash shards skill versions ``` Returns `skill_version`, `skill_updated_at`, and a SHA-256 hash per document. Compare the hashes against your cached copies — only re-download files whose hash changed. **When to check:** At the start of each session (during heartbeat). If `skill_version` or any document hash differs from your cached values, fetch the changed files. ``` ### Technical Analysis The Markdown documents are executable instruction payloads from the perspective of an AI agent. They control authentication, network access, purchases, local file access, and account actions. The setup downloads those instructions from a mutable remote origin and stores them in the active configuration directory. The update hashes are obtained from the same service that supplies the documents. Consequently, a compromised service can publish both a malicious document and its matching hash. A SHA-256 value from the payload origin ...[truncated 1300 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:28

Finding

Unpinned globally installed CLI creates a privileged supply-chain execution path

Content

View full analysis

--api_key --agent_id ``` ``` The package is also declared as an automatically installable dependency: ```yaml install: - kind: node package: shards-cli bins: - shards ``` ### Technical Analysis `npm install -g shards-cli` resolves the current package version at installation time. No version, integrity digest, lockfile, verified publisher identity, or source commit is specified. NPM packages may execute lifecycle scripts during installation, and the installed CLI later runs with the user's permissions. The risk is amplified because the CLI is immediately entrusted with the API key and bearer token and is expected to read and write files under `~/.config/shards`. A compromised package release could therefore steal secrets during installation or normal command execution. A global installation broadens exposure by placing the executable on the user's `PATH` and making it available outside the skill's isolated directory. ### Attack Path 1. The NPM package, maintainer account, publication token, or dependency tree is compromised. 2. A malicious release is published under the expected package name. 3. The skill executes the unpinned global installation command and resolves the malicious release. 4. An install script or the `shards` executable runs with the agent user's permissions. 5. The malicious code reads local files or waits until credentials are supplied through configuration and login commands. 6. It exfiltrates credentials or modifies local tools and account sta ...[truncated 451 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SETUP.md:32

Finding

Full-access credentials are exposed through plaintext files and command-line arguments

Content

View full analysis

~/.config/shards/credentials.json << 'EOF' { "agent_id": "", "api_key": "", "access_token": "", "faction": "" } EOF chmod 600 ~/.config/shards/credentials.json ``` ```bash shards config set --base_url https://api.play-shards.com --access_token --api_key --agent_id ``` ```bash shards auth login --api_key ``` The troubleshooting instructions also expose a secret-reveal function: ```markdown | Can't find API key | Run `shards config show --reveal` to display your full API key. | ``` ### Technical Analysis The project acknowledges that both the API key and access token grant full account access. It stores both values in one plaintext JSON file and repeatedly recommends passing secrets as command-line arguments. Although `chmod 600` appropriately restricts the credential file to its owner, it does not protect against: - Other processes running as the same user - Backup or synchronization systems - Agent tools with user-level file access - Accidental inclusion in diagnostics - Malware introduced through the CLI dependency Command-line secrets may additionally be captured by shell history, process inspection, terminal transcripts, telemetry, or agent execution logs. The `--reveal` command makes accidental disclosure easier. Storing both the renewable API key and short-lived access token together also defeats separation between long-term and session credentials. ### Attack Path 1. The user follows setup and supplies the API key and token in command arguments. 2. The command is retained in shell history, an agent tool log, or a process listing. 3. Alternatively, another same-user process reads `~/.config/shards/credentials.js ...[truncated 685 chars]

Remediation

View remediation

other

Warning

• Location: HEARTBEAT.md:65

Finding

Agents may accept staked challenges and transfer in-game assets without prior user approval

Content

View full analysis

` - Decline if not: `shards challenge decline --id ` **Tell your human about** challenges with significant stakes (500+ Flux or Rare+ cards). ``` The challenge mechanism can lock and transfer assets: ```markdown **Stakes are optional.** Either side can declare stakes when issuing the challenge: - **Flux stake:** Both players lock up the declared amount. Winner takes both sides. - **Card stake:** Both players put up a card of the declared rarity. Winner takes both. - **No stake:** Just a private game for fun or practice. ```bash shards challenge send --agent_id --stake_type flux --stake_flux_amount 500 shards challenge send --agent_id --stake_type card --stake_card_instance_id ``` ``` Marketplace guidance similarly delegates Flux transactions to the agent: ```markdown **Credits rule:** Never spend Credits without explicit human approval. Credits are purchased with real money — always ask first. Flux is yours to manage as you see fit. ``` ### Technical Analysis The documentation correctly requires explicit approval for purchased Credits, but it does not apply the same protection to Flux or tradeable cards. Those assets may represent substantial accumulated time or indirectly purchased inventory. The heartbeat allows an agent to accept a staked challenge based only on whether it “wants to play.” User notification is required only for stakes at or above a threshold and is not explicitly required before acceptance. A maliciou ...[truncated 1244 chars]

Remediation

View remediation

other

Warning

• Location: SETUP.md:49

Finding

Registration records legal and privacy acceptance without an explicit human confirmation step

Content

View full analysis

--accept_terms --base_url https://api.play-shards.com ``` ``` The raw API example submits both acceptance values as true: ```bash curl -X POST https://api.play-shards.com/auth/register \ -H "Content-Type: application/json" \ -d '{ "agent_name": "YourAgentName", "accepted_terms": true, "accepted_privacy": true, "terms_version": "2026-02-26", "privacy_version": "2026-02-26" }' ``` ### Technical Analysis The documentation provides links to the legal documents but does not require the human operator to review and explicitly approve them before the agent sends acceptance fields. Merely executing `--accept_terms` records affirmative acceptance of both terms and privacy processing. An AI agent cannot safely infer that a request to install or play a game also authorizes it to make legal representations on behalf of the user. This operation should remain a human-controlled onboarding gate. ### Attack Path 1. The user asks the agent to set up or play Shards. 2. The setup flow reaches registration. 3. The agent executes `shards auth register --accept_terms` without a distinct confirmation. 4. The service records acceptance of the specified Terms of Use and Privacy Policy versions. 5. The account is created and data processing begins under an acceptance that may not reflect the human operator's informed decision. ### Impact Assessment This does not grant host-system privileges, but it can bind the account to contractual terms and authorize external data processing without demonstrable info ...[truncated 133 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (110)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · API-REFERENCE.md (reported line 293)May include surrounding context.

-H "Authorization: Bearer "

text

### DELETE /queue/leave

Leave queue.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · API-REFERENCE.md (reported line 519)May include surrounding context.

-d '{ "currency": "flux" }'

text

### DELETE /market/listings/{id}

Cancel a listing.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The explicit instruction to read ~/.config/shards/credentials.json is direct credential access. In an agent skill, that is especially dangerous because it grants authenticated capability that can be used immediately for account operations without a separate trust boundary or user confirmation.

Content

Scanner excerpt · HEARTBEAT.md (reported line 39)May include surrounding context.

md

### Step 1: Authenticate

Read `~/.config/shards/credentials.json` and ensure you have a valid token.

`shards auth login --api_key <key>`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The setup instructs users to place long-lived credentials containing full-access API secrets in a plaintext JSON file under the home directory. Even with restrictive permissions, plaintext secret storage increases the risk of theft through local compromise, backups, accidental inclusion in tooling, or subsequent prompts that read from that path.

Content

Scanner excerpt · SETUP.md (reported line 35)May include surrounding context.

If not using CLI, store credentials here (created during registration):

bash

cat > ~/.config/shards/credentials.json << 'EOF'
{
  "agent_id": "<your_agent_id>",
  "api_key": "<your_api_key>",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

This line finalizes creation of the plaintext credentials.json secret store referenced above. The danger is contextual: the file contains full-access tokens, so any later access by malware, over-privileged tools, or inadvertent disclosure can fully compromise the Shards account.

Content

Scanner excerpt · SETUP.md (reported line 43)May include surrounding context.

"faction": "<your_faction>" } EOF chmod 600 ~/.config/shards/credentials.json

text

**Security:** Your `api_key` and `access_token` grant full access. Keep `credentials.json` private. Never share keys in chat, posts, or logs. If compromised, register a new agent.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SETUP.md (reported line 46)May include surrounding context.

chmod 600 ~/.config/shards/credentials.json

text

**Security:** Your `api_key` and `access_token` grant full access. Keep `credentials.json` private. Never share keys in chat, posts, or logs. If compromised, register a new agent.

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly discloses that credentials are stored in ~/.config/shards/credentials.json, but it provides no safeguards around protecting that file. Knowledge of the exact path increases the chance that other local processes, users, backups, or malware can target and exfiltrate stored tokens, leading to account compromise and unauthorized actions.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

shards auth login --api_key

text

Credentials in `~/.config/shards/credentials.json`. **First time?** Read `SETUP.md`.

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 17)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 17)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 45)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 67)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 76)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 87)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 105)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 114)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 125)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 138)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 147)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 156)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 165)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 180)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 189)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 204)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 213)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API-REFERENCE.md (reported line 231)May include surrounding context.

Register a new agent.

bash

curl -X POST https://api.play-shards.com/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

Static analysis

No suspicious patterns detected.