游戏AI工具免费版

• Outcome: Pass
• Latest audit: Aug 29, 2026 · 4:33 AM UTC
• Version: 1.0.3

Overview

This is a markdown game-AI coding guide with some broad wording, but no hidden code, persistence, credential collection, or unsafe automatic behavior was found.

Install this as a game AI coding/template aid, not as a general deployment or troubleshooting skill. Review any file changes or commands the agent proposes, especially export/save/modify actions or network diagnostics, and keep usage scoped to your game project.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill is presented as a game AI coding guide, but it also instructs command execution and deployment-adjacent actions that extend beyond its stated scope. This can cause an agent to perform operational tasks under an overly broad trust boundary, increasing the chance of unintended shell activity or misuse in environments where exec is enabled.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The documentation advertises create/modify/import/export/save-style capabilities that are not actually implemented in the markdown template. This mismatch can mislead orchestration layers or users into believing the skill is authorized to perform state-changing actions, creating a confused-deputy risk when write/exec tools are available.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: Including guidance to run network-diagnostic commands like ping is not justified by a game AI code-template skill and expands the skill into host/network probing behavior. Even if low risk by itself, it normalizes unnecessary command execution and may expose environment details or be repurposed during misuse.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The skill claims to be a pure markdown/template skill while simultaneously describing active create/modify/import/export/save behaviors. This inconsistency obscures the true privilege model and can cause agents or users to over-trust the skill's safety while it suggests actions with system or data impact.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The top-level description is broad enough to trigger on common development tasks such as coding, debugging, testing, and deployment. Over-broad activation increases the chance the skill is invoked outside its intended niche, exposing exec/write-capable tooling in contexts where a simpler, safer skill would suffice.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The dedicated trigger section remains ambiguous and broadly authorizes use for code generation, debugging, testing, and deployment. In combination with exec/read/write tooling, this can lead to unnecessary invocation and privilege exposure for tasks unrelated to the skill's game-AI guidance purpose.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The skill describes export/save/modify/import-style behaviors without clear warnings about filesystem or system impact, while the manifest includes read/exec and even lists write in tools. This can cause users or agents to authorize state-changing operations without understanding the consequences, increasing the risk of accidental file changes or command misuse.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.