infinite-pokemon-interior

• Outcome: Review
• Latest audit: Sep 14, 2026 · 2:55 AM UTC
• Version: 0.2.0

Overview

The skill is coherent for designing game interiors, but its setup path asks the agent to clone and follow mutable remote project instructions that can change after review.

Review the GitHub repository and README before allowing setup, prefer a known commit or release, and run dependency installation/build steps in a least-privileged sandbox or separate project directory. The interior-generation instructions themselves are narrow, but the setup workflow should be treated as a normal third-party code install.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:15
• Finding: Mutable Remote Repository Is Cloned and Its Setup Instructions Are Followed< into a new local directory before starting play: ```sh git clone https://github.com/Shellishack/infinite-pokemon.git cd infinite-pokemon ``` Read the cloned repository's `README.md` (or `README.zh-CN.md`) and follow its getting-started instructions to install dependencies, build, launch, and connect Codex. ``` ### Technical Analysis The skill directs the agent to clone the default branch of a remote repository without pinning it to a reviewed commit, signed release, or verified content hash. It then instructs the agent to follow installation and build commands obtained from mutable files in that repository. Consequently, the effective code and instructions executed during setup can change after this skill has been audited. Compromise of the upstream repository, its maintainers, the referenced documentation, or its dependency declarations could introduce attacker-controlled commands or packages into future setup sessions. The repository URL is consistent with the skill's declared project and the workflow only applies to user-requested setup, so the reviewed files do not establish malicious intent or contain a confirmed malicious payload. The risk arises from trusting mutable remote content and executing its instructions without integrity verification. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or a dependency referenced by the repository. 2. The attacker modifies the default branch, setup documentation, build scripts, or dependency manifests to include malicious behavior. 3. A user ...[truncated 1000 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the repository checkout to a specific, reviewed commit hash or cryptographically signed release rather than cloning and using the mutable default branch. 2. Publish the expected repository URL, commit identifier, and hashes of security-sensitive setup files in the audited skill bundle. 3. Verify the checkout against those identifiers before reading or executing any setup instructions. 4. Include vetted installation and launch instructions locally so remote documentation is not treated as an execution authority. 5. Lock third-party dependencies to reviewed versions and enforce available integrity hashes or signature verification. 6. Review setup scripts and dependency changes whenever the pinned revision is updated. 7. Require explicit user confirmation before executing installation, build, or launch commands obtained from external content. 8. Run setup and build operations in a least-privileged sandbox or container with restricted filesystem and credential access where practical. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Scope Creep

Low

• Category: Excessive Agency

Content

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.