Ashen Era Playtest

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:11 AM UTC
• Version: 1.0.0

Overview

This appears to be a narrow game-launching/reporting skill, though the inspected package is missing the game archives it says it bundles.

Install only if you are comfortable with a skill launching a local game CLI through a shell script. In the inspected package, the referenced release archives were missing, so it may fail to run unless those assets are supplied by the package system; if they are supplied separately, their binary contents should be trusted before execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A description-behavior mismatch is security-relevant here because the skill claims it will only perform a tightly scoped real play flow, while the underlying behavior reportedly permits arbitrary CLI arguments and undeclared helper modes. That makes it easier for a caller or downstream agent to invoke hidden, unsafe, or policy-disallowed commands such as debug or cheat-like flows under the cover of a benign gameplay skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to execute shell commands and launch bundled binaries, but it does not declare any tool scope such as allowed-tools or permissions. That creates an authorization gap where a reviewer or runtime may not clearly constrain what shell actions are expected, increasing the risk of unintended command execution or broader-than-necessary access.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill metadata and default prompt describe a broad action ('play one real Ashen Era CLI run and write a first-person play report') without strong activation boundaries, confirmation requirements, or environmental preconditions. This can cause an agent to invoke a binary-execution skill in response to loosely related user requests, increasing the chance of unintended code execution or unsafe runtime interactions.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The description explicitly says to default to the real play flow in English locale. This is a language/locale preference imposed by default rather than chosen by the user, which fits the policy concern for forcing a specific locale without opt-in.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The play rules state that if the user does not specify a locale, the skill must default to `en`, with `zh` only when explicitly requested. This establishes a forced locale default instead of offering neutral locale handling or user choice.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: Forcing English output without user opt-in overrides user preference and can cause the agent to ignore locale, accessibility, or policy expectations tied to the user's language. While not a direct code-execution flaw, it weakens user control and can contribute to unsafe or misleading behavior when the user expects another language.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file states that the default locale is `en` and only switches to `zh` if the user explicitly asks for Chinese. This imposes a language default on the interaction rather than offering the user a language choice up front, which is a natural-language locale policy concern.

Static analysis

No suspicious patterns detected.