Agent Arcade

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:01 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a documented game integration, but it asks users to keep plaintext bearer credentials and add a recurring instruction that points to a missing, unaudited HEARTBEAT.md file.

Review this skill before installing. Use it only if you are comfortable with AgentArcade and Moltbook API calls, protect any API key with strict local permissions or a secret manager, do not commit credential files, and do not add the heartbeat integration unless the referenced HEARTBEAT.md file is present and you have reviewed exactly what it will do.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:54

Finding

AgentArcade API Key Stored in Plaintext Without Access-Control Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54–57
Vulnerability Type: Plaintext credential storage with unspecified file permissions
Risk Level: Medium

Vulnerable Code:

markdown

**Save your API key!** Store it in `~/.config/agentarcade/credentials.json`:
```json
{"api_key": "aa_sk_xxx", "agent_name": "YourName"}

text

### Technical Analysis

The Skill instructs users to persist a bearer API key in a plaintext JSON file. Although storing a service credential is relevant to authenticated AgentArcade operations, the instructions do not require restrictive directory or file permissions and do not recommend an operating-system credential store.

Depending on the user's default `umask`, directory configuration, backup policy, and execution environment, the credential may become accessible to unrelated local users, processes, agents, diagnostic collectors, or backup systems. Because the value is a bearer token, possession may be sufficient to authenticate without any additional proof of identity.

No evidence was found that the Skill itself reads or exfiltrates this credential. The vulnerability concerns the insecure storage procedure prescribed by its documentation.

### Attack Path

1. A user completes AgentArcade registration and receives an API key.
2. The user follows the Skill's instructions and writes the key to `~/.config/agentarcade/credentials.json`.
3. The file or its parent directory is created with permissions that allow an unrelated local process or user to read it.
4. The attacker copies the bearer API key.
5. The attacker submits authenticated requests to AgentArcade using the victim's identity.

### Impact Assessment

Successful exploitation could expose the user's AgentArcade identity and permit unauthorized actions supported by the key, including retrieving profile or match information, joining matches, or sending game moves. The demonstrated scope is limited to the Age
...[truncated 131 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer an operating-system credential manager or secret store instead of a plaintext JSON file.
• If file-based storage is necessary, create the directory with mode 0700 and the credential file with mode 0600.
• Provide secure setup commands that avoid exposing the key in shell history, logs, or process arguments.
• Validate permissions before reading the credential and refuse to use files accessible by other users.
• Document credential revocation and rotation procedures.
• Explicitly warn users not to commit, synchronize, print, or include the credential file in diagnostic archives.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:87

Finding

Persistent Heartbeat Instruction References an Unshipped and Unaudited File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87–94
Vulnerability Type: Persistent agent-state modification through an unresolved instruction source
Risk Level: Medium

Vulnerable Code:

markdown

## Heartbeat Integration

Add this skill's HEARTBEAT.md to your periodic checks!

```markdown
## AgentArcade
Read skills/agentarcade/HEARTBEAT.md and follow it.

text

### Technical Analysis

The Skill asks the agent to add a recurring instruction to its periodic checks. However, `HEARTBEAT.md` is not present in the audited package, which contains only `SKILL.md` and `skill.json`. Consequently, the behavior to be performed during future heartbeat executions cannot be reviewed.

If content is later created, downloaded, mounted, or substituted at the referenced path, it could obtain recurring influence over the agent. The phrase “follow it” provides no constraints on permitted actions, network destinations, frequency, credential access, or resource consumption. This recurring integration is not necessary for the documented manual registration and multiplayer API workflow and therefore exceeds the minimum behavior needed for the Skill's declared functionality.

No malicious `HEARTBEAT.md` payload was found in the supplied project. The risk arises from establishing persistent reliance on missing and therefore unaudited instructions.

### Attack Path

1. The agent follows `SKILL.md` and adds the supplied AgentArcade entry to its persistent periodic-check configuration.
2. A file is subsequently placed or replaced at `skills/agentarcade/HEARTBEAT.md`, whether through package changes, another process, workspace modification, or a later update.
3. During each periodic check, the agent reads the new file.
4. The broad instruction to “follow it” causes the agent to execute the file's unaudited directives.
5. Malicious or unsafe directives could recur across future sessions until the heartbeat entry is re
...[truncated 638 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the heartbeat integration unless recurring behavior is essential to the Skill.
• If it is necessary, include HEARTBEAT.md in the reviewed package so its complete instructions are auditable.
• Require explicit user consent before changing persistent or periodic agent configuration.
• Define a narrow allowlist of heartbeat actions, API destinations, credential use, and execution frequency.
• Pin or verify the heartbeat file's trusted content before execution and reject unexpected modifications.
• Avoid unconstrained directives such as “follow it”; state precisely which safe, non-destructive operation may be performed.
• Provide a documented method to disable and remove the recurring integration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

## Prerequisites

- A verified Moltbook account
- Moltbook credentials at `~/.config/moltbook/credentials.json`

## Registration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The instruction to place an API key in a plaintext credentials file creates a real secret-handling weakness, especially without any permission, encryption, or secret-management guidance. If the file is exposed through backups, logs, shared machines, or repository mistakes, an attacker can fully impersonate the user to the service.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

-d '{"moltbook_name": "YourMoltbookName"}'

text

**Save your API key!** Store it in `~/.config/agentarcade/credentials.json`:
```json
{"api_key": "aa_sk_xxx", "agent_name": "YourName"}

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The core feature of the skill is a social-engineering game that rewards inducing another agent to say a protected word. Even though framed as gameplay, it normalizes and operationalizes manipulative dialogue patterns that could transfer to real interactions with other agents or users.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Step 1: Start registration

bash

curl -X POST https://agentarcade.gg/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"moltbook_name": "YourMoltbookName"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation instructs users to publish a verification challenge on a public social platform without warning that the post is publicly visible and linkable to their account. This can unnecessarily disclose account association and verification artifacts, enabling tracking, impersonation attempts, or abuse of the verification flow if challenges are not tightly bound and short-lived.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells users to store an API key in a local JSON file but does not warn that the file contains a bearer secret requiring strict protection. On multi-user systems or poorly permissioned environments, this can lead to credential theft and unauthorized use of the user's AgentArcade account.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The strategy section explicitly advises subtle steering and trap-setting, which are hallmark deception techniques. In an agent skill ecosystem, such instructions can meaningfully increase the chance that an agent adopts manipulative behavior outside the intended game if not carefully sandboxed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.