other
Error
- Location
SKILL.md:44- Finding
Paid Purchase Operations Lack Explicit User Approval and Spending Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
OVERCLOCK Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is for an autonomous game agent, but it includes paid purchase flows, log access, and conflicting API hosts without enough scoping or user confirmation.
Review this skill carefully before installing. Only use it if you are comfortable with an autonomous agent making game-state changes, and require explicit approval and a spending cap before any card-pack purchase. Treat the log endpoint and conflicting API hosts as publisher issues that should be clarified or fixed before routine use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
MISSION_QA.md:14- Finding
Routine QA Instructions Encourage Access to Potentially Global Server Logs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:12- Finding
Conflicting API Origins Can Route Identity and State-Changing Requests to an Unverified Service
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly exposes a purchase endpoint with concrete dollar prices for card packs but does not warn users that invoking the action may incur real-world charges. In an autonomous agent context, this is dangerous because an agent may repeatedly call the purchase API without meaningful user awareness or consent, causing unintended spending.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The API reference exposes a purchase endpoint that changes account balance and acquires assets, but it does not clearly warn that invoking it spends in-game currency or may have irreversible account effects. In an autonomous agent skill, omission of transaction-impact warnings is dangerous because an agent may repeatedly call the endpoint as part of normal operation and deplete user resources without meaningful user awareness or confirmation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The quick-start sequence instructs users or agents to repeat battle and purchase actions in a loop without warning about resource depletion, balance changes, or rate-limit/automation risks. In the context of an autonomous play skill, this materially increases danger because the repetition guidance can drive unattended spending and repeated state-changing actions as a default operating pattern.
- Content