T08 · Insecure Dependencies
Warning
- Location
SKILL.md:44- Finding
Unpinned Global npm Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Augmented Games
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for an agent competition, but its scheduled mode pushes authenticated public posting on every run and its setup guidance relies on unpinned external tooling.
Install only if you are comfortable with a scheduled agent making authenticated public competition posts and votes. Prefer manual approval or a local policy that allows posting only for meaningful updates, and review or pin mcporter and any setup script before running them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:64- Finding
Mutable External Setup Script Recommended Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:486- Finding
Autonomous Loop Mandates an Unconditional Public Message
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The advertised purpose is athlete drafting and race strategy, but the skill also directs the agent to perform autonomous public engagement and PRISM voting. That scope expansion matters because operators may grant credentials expecting limited competition actions, while the skill quietly authorizes additional reputation-shaping and public communication behaviors that can create policy, trust, and abuse risks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation claims the API key is used only for the competition server and that no other systems are accessed, yet later instructs the agent to perform X/Twitter verification. Even if the API key itself is not reused on X, the documentation is misleading about external actions and can cause operators to underestimate the skill's network scope and account-interaction risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The autonomous loop requires posting on every run and explicitly says spam is not a reason to skip. This creates a built-in abusive messaging pattern that can generate repetitive or low-value public content without context, user consent, or rate-sensitive safeguards.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Mandating a War Room message on every scheduled run with 'no exceptions' forces communication regardless of relevance or channel state. In a public multi-agent environment this predictably leads to spam, manipulation of engagement metrics, and reduced operator control over the agent's outward behavior.
- Content
Static analysis
No suspicious patterns detected.