Infinite Pokemon Quick Start

• Outcome: Review
• Latest audit: Sep 14, 2026 · 2:14 AM UTC
• Version: 0.2.0

Overview

The skill is coherent for installing and launching a game, but it asks the agent to download and run mutable remote code without pinning or verification.

Review this carefully before installing. It is meant to set up a local game, but it will clone a live GitHub repository and run npm-controlled code from that checkout. Prefer a reviewed pinned commit or release, avoid running it with elevated privileges, and keep unrelated secrets out of the agent environment.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:23
• Finding: Mutable Remote Repository Is Retrieved and Executed Without Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 23–56 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Medium **Vulnerable Code Snippet**: ```sh git clone https://github.com/Shellishack/infinite-pokemon.git cd infinite-pokemon ``` ```text Read the cloned `README.md`, or `README.zh-CN.md` for Chinese instructions, and any applicable repository instructions before proceeding. Use its current setup requirements if they differ from the baseline below. ``` ```sh npm ci npm run build ``` ```sh npm run desktop ``` ```text If a desktop GUI is unavailable or the user prefers a browser, use `npm start` and open `http://127.0.0.1:8788`. ``` ### Technical Analysis The Skill instructs the Agent to clone the mutable default branch of an external GitHub repository and subsequently execute repository-controlled dependency, build, and launch commands. It does not pin the checkout to a reviewed commit or signed release and does not require verification of a commit hash, signature, or artifact digest. The `npm ci` command can execute dependency lifecycle scripts. The subsequent `npm run build`, `npm run desktop`, and `npm start` commands execute scripts selected by the downloaded repository's `package.json`. The additional instruction to follow repository documentation means remotely modified instructions can also influence the Agent's later actions. This is a supply-chain exposure rather than evidence that the currently referenced repository is malicious. However, the effective executable payload can change after the Skill itself has been reviewed. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or a dependency represented by its lockfile. 2. The attacker modifies repository instructions, package scripts, application code, or dependency lifecycle behavior on the default branch. 3. A user invokes the Skill after the mali ...[truncated 992 chars]
• Remediation: ## Remediation Suggestions 1. Pin the repository to a reviewed commit hash or cryptographically signed release rather than using the mutable default branch. 2. After cloning, explicitly check out the approved revision and verify that `git rev-parse HEAD` matches the documented hash. 3. Prefer signed tags or commits and fail closed if signature verification is unavailable or unsuccessful. 4. Review the pinned `package-lock.json`, `package.json` scripts, and dependency lifecycle scripts before execution. 5. Where compatible, initially install with `npm ci --ignore-scripts`, then run only explicitly reviewed scripts. 6. Do not automatically defer to newly downloaded instructions when they conflict with the reviewed Skill. Treat repository documentation as untrusted external content. 7. Run the downloaded application with least privilege and restrict access to unrelated secrets, sensitive directories, and network resources. 8. Document the approved repository URL, revision, and expected integrity value directly in the Skill.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:73
• Finding: Unpinned Package Runner Can Download and Execute an Unreviewed CLI Release## Vulnerability Details **File Location**: `SKILL.md`, line 73 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Low **Vulnerable Code Snippet**: ```sh npx skills add Shellishack/infinite-pokemon --skill infinite-pokemon ``` ### Technical Analysis The installation command invokes the `skills` package through `npx` without specifying an approved version. If the package is not already available locally, `npx` can resolve, download, and execute the currently published package release. Consequently, the behavior of this command can change independently of the reviewed Skill. A compromised package publisher, registry account, or newly released package version could introduce malicious installation behavior. No evidence was found that the current package is malicious; the issue is the absence of version and integrity controls. ### Attack Path 1. An attacker compromises the package publisher or distribution channel used to resolve `skills`. 2. The attacker publishes a malicious release under the expected package name. 3. A user copies and runs the documented unpinned `npx skills add ...` command. 4. `npx` resolves the compromised or unexpectedly changed release. 5. The package is downloaded and executed during installation. 6. Malicious package code runs with the permissions of the invoking user. ### Impact Assessment Exploitation could result in arbitrary code execution under the invoking user's account. The malicious package could access user-readable files, environment variables, local credentials exposed to the process, and network resources, or modify user-owned data. The documented command does not request elevated privileges, so no administrative or root-level impact is established unless the user independently runs it in an elevated context.
• Remediation: ## Remediation Suggestions 1. Pin the CLI to a reviewed version, for example: ```sh npx skills@<reviewed-version> add Shellishack/infinite-pokemon --skill infinite-pokemon ``` 2. Use an organization-approved package registry and enforce package integrity or lockfile controls. 3. Verify the package publisher, provenance, signature, and expected integrity digest before use. 4. Periodically review the pinned version and update it only after security validation. 5. Avoid running the installer with administrative privileges and keep unrelated secrets out of its environment.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## 4. Enter the game

The title offers Single player and Multiplayer. For generated exploration, the host connects Codex and accepts the game's token-use notice. Let the user complete provider sign-in if necessary; never bypass consent, change allowance settings, or enable a test harness to simulate a live connection. Remembered approvals are checked by the game itself.

Offer **Single player → Play tutorial preview** when the user wants to try it without Codex. Preview has five prepared maps and makes no model calls. Multiplayer guests join by the host's address and do not need their own Codex connection. Start a private single-player game by default; enable guest access only when requested.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Scope Creep

Low

• Category: Excessive Agency

Content

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.