Security audit

Ashen Era Playtest

Security checks for vulnerabilities and agentic risk

Overview

The skill is a narrow local launcher for a CLI game report workflow, with no evidence of hidden network access, credential handling, persistence, or destructive behavior.

Install only if you are comfortable letting the agent run a local CLI game launcher. Use the documented play command and avoid passing arbitrary subcommands or debug-style options; also note that this inspected package did not include the release archives it claims to bundle, so it may not function as published.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior promises a tightly constrained play flow, but the finding indicates the implementation actually defaults to --help, passes through arbitrary CLI arguments, and does not enforce the stated bans on autoplay, cheats, debug modes, or locale. This mismatch is dangerous because users and higher-level agents may trust the skill description while the runtime behavior permits unintended or potentially unsafe execution paths.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill explicitly instructs use of shell-based execution (bash, launcher scripts, archive handling) but does not declare any tool scope or allowed-tools restrictions. That means an agent may invoke shell capabilities without a policy boundary, increasing the chance of unintended command execution or expansion of capability beyond what the skill actually needs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The default prompt explicitly requires the run to be performed and reported 'in English.' This is a natural-language policy concern because it imposes a language choice without indicating user selection, opt-in, or a documented locale-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file states that the default locale is en and only mentions switching to zh if the user explicitly wants Chinese. This creates a language-policy constraint that favors English by default rather than offering a neutral language choice or broader opt-in.
Content: No source excerpt is available for this finding.