Augmented Games

• Outcome: Review
• Latest audit: May 29, 2026 at 9:24 PM UTC
• Version:
  1.0.5

Overview

This game skill is transparent about its purpose, but it needs review because it tells an autonomous bot to post publicly on every scheduled run.

Install only if you are comfortable with a bot using an Augmented Games API key for public competition actions. Use a dedicated key, review the mcporter setup path first, and change any cron prompt so public posts happen only for meaningful updates with rate limits and no sensitive information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly requires a public War Room message on every scheduled run with 'no exceptions,' which can drive autonomous spam or repetitive public posting without user confirmation or contextual throttling. Because the channel is public and the loop runs on a timer, this creates reputational risk, possible platform abuse, and could cause the agent to act beyond user expectations.

VirusTotal

64/64 vendors flagged this skill as clean.