Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a game-AI Markdown guide, but it asks for broad exec/write-capable authority and includes loosely scoped deployment and network-diagnostic guidance beyond that purpose.
Review before installing. The content appears to be ordinary game-AI guidance, not malware, but it should be tightened to game-AI tasks only and should not receive exec/write authority unless you explicitly want the agent to run commands or edit project files for this skill.
The manifest description uses vague, expansive activation guidance that can match many general-purpose coding requests. In an agent ecosystem, this can lead to inappropriate auto-selection of a skill with read/exec/write access, broadening exposure beyond its intended educational game-AI role.
The manifest description explicitly says the skill supports Chinese interaction, and the document is written to position Chinese interaction as the default behavior, but it does not offer user language choice or explain a necessary region-specific limitation. This may violate language/locale policy if users are steered into a specific language without opt-in.
The skill is presented as a Markdown-based game AI guide, but it also instructs operational behavior such as deployment-related use and network diagnostics. This expands the trust boundary from documentation into agent action, increasing the chance that an agent will run commands unrelated to the narrow game-AI guidance purpose.
The trigger condition is broad enough to match common software-development tasks such as coding assistance, debugging, testing, and deployment. Overbroad activation can cause this skill to be selected in unrelated contexts, exposing powerful tools and instructions where they are not needed and increasing the chance of unintended command execution or unsafe outputs.
The documented recommendation to execute ping/network diagnostic commands is not justified by a game AI code-template skill. Unnecessary shell-capable guidance can cause the agent to perform environment probing or network activity outside user intent, especially because the manifest enables exec/write tools.
The file labels the skill as 'MD (纯 Markdown 指令 + 代码模板)' and says it is driven by natural-language instructions. Elsewhere it includes executable shell examples and security guidance specifically about command execution and HTTPS/network communication, which contradicts the idea that it is only passive Markdown/template content.
No suspicious patterns detected.
