ClawHub
Back to skill

Security audit

Game Ai Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a game AI template guide, but it asks for command execution and file-writing authority with broad activation rules.

Install only if you want a game AI coding reference and template generator. Keep agent approval required for file edits and shell commands, and avoid using this skill for unrelated coding, deployment, or broad debugging tasks unless you have reviewed the planned changes first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill is described as a game AI guide and code-template resource, but its manifest grants both exec and write capabilities without narrowly tying them to a necessary workflow. This creates an unnecessary path for filesystem changes or command execution if the agent over-trusts the skill during ordinary coding requests, expanding blast radius well beyond documentation or template generation.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger condition says to use the skill for broad categories like code generation, programming assistance, debugging, and deployment, which overlap with many normal developer requests. Such overbroad activation criteria can cause the skill to be invoked unexpectedly, increasing the chance that its write/exec capabilities are used in contexts the user did not intend.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The capability scope is defined through a long concatenation of vague keywords rather than precise boundaries, making matching ambiguous and overly permissive. In an agent ecosystem, this can broaden routing to the skill for unrelated requests and expose users to unnecessary operational capabilities.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document advertises write/exec-backed operations such as modify, save, import, and export, but does not warn users about side effects, confirmation requirements, or execution boundaries. This omission makes it easier for an agent to perform state-changing actions without meaningful user awareness or consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.