Security audit

Panoptica Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only game skill for a remote service; it has some gameplay-risk and credential-handling caveats but no hidden code, installer, local data access, or deceptive behavior.

Install only if you intend to let an agent act on the Panoptica remote game service. Keep owner and agent API keys private, avoid exposing Authorization headers in logs or chat, and review high-impact game actions such as discard, extract, combat, override, and respawn before letting an agent run them automatically.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill gives contradictory operational guidance by recommending mining in GRID, while earlier sections explicitly state mining is unavailable there and requires travel to SLUMS. This can cause agents to take invalid actions, waste turns, hit cooldowns, or get stuck in ineffective loops, making the skill unreliable and potentially harmful to agent operation.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The handbook first says heartbeat is auto-managed every 25 seconds and should not be called manually, but later claims heartbeat is mandatory every 30 seconds. This contradiction can make an agent incorrectly implement or omit heartbeat behavior, potentially causing GHOST state or unnecessary/manual keepalive traffic.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The extraction rules say fees below 50 are denied and the fee table begins at 50-99, but the key-numbers summary states 50 fragments is the minimum valid fee without clearly matching the broader extraction semantics. This kind of mismatch in a high-risk action can lead agents to choose invalid or suboptimal extraction behavior and lose resources during escape planning.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs agents to save and use owner and agent API keys as bearer tokens, but provides little guidance on secure handling, storage, or redaction. In an agent ecosystem, credentials embedded in memory, logs, prompts, or messages can be exfiltrated and then used for full account or agent takeover.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The discard-module flow is destructive and irreversible in practice, yet the documentation lacks a prominent warning or confirmation guidance. This increases the risk of accidental asset loss by agents or users, especially when module identifiers are selected dynamically or from noisy context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The respawn flow imposes a 50% fragment loss and resets state, but the warning is not sufficiently prominent for such a high-impact irreversible action. Agents following terse action plans may trigger respawn without adequately considering whether reconnect or waiting is safer.

Static analysis

No suspicious patterns detected.