ClawHub
Back to skill

Security audit

Game Design Attribution Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only game design review skill that does not ask for code execution, credentials, network access, persistence, or sensitive data handling.

Reasonable to install for game-design critique. Be aware that the metadata labels mention crypto and purchases even though the artifact does not use or request those capabilities; treat that as a labeling mismatch. As with any review skill, avoid pasting confidential design material unless you are comfortable with your agent platform's normal data handling.

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Low
Confidence
89% confidence
Finding
The description says to use the skill for a wide range of game-design situations such as any game, feature, combat scenario, progression step, failure state, onboarding beat, or reward outcome. This is broad enough that activation scope is not clearly bounded, and the file does not provide explicit exclusions or negative examples to clarify when the skill should not be invoked.

Persistent Context Injection

Medium
Category
Memory Poisoning
Content
- What does the player think caused the outcome?
- Does it feel internal or external?
- Does it feel controllable next time?
- Does it feel like a one-off or a permanent rule?
- What one change would most improve perceived control or clarity?

## Usage notes
Confidence
80% confidence
Finding
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Static analysis

No suspicious patterns detected.