游戏AI

• Outcome: Review
• Latest audit: Aug 10, 2026 · 11:19 AM UTC
• Version: 1.0.1

Overview

This game-AI skill is mostly a markdown development guide, but it requests shell and broad file authority with loose scope around coding, deployment, file writes, and credentials.

Review before installing. Use this only for game-AI project work, keep file access limited to the intended project, and approve shell commands or credential use only when the exact purpose and target path are clear.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill presents itself as a game AI development guide, yet declares powerful tools such as exec plus broad file-reading/search capabilities that are not narrowly scoped to that purpose. This creates unnecessary attack surface: a user invoking a seemingly educational skill could be induced to run shell commands or inspect local files beyond what is needed for game-AI assistance.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The invocation guidance is overly broad, tying this skill to generic coding, debugging, and deployment scenarios rather than narrowly to game AI tasks. Combined with powerful tools like exec, broad triggers increase the chance the skill is auto-selected in unrelated contexts where it may gain unnecessary access to commands or local project data.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: Claiming file handling and write-like capabilities without a clear warning about modifying user data weakens informed consent and can lead to unintended changes to local files. In an agent setting, even ambiguous claims about file operations are risky because users may not realize the skill could alter project artifacts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill advertises command execution but does not clearly warn about system-impacting operations, despite also listing exec as an available tool. In context, this is more dangerous because the skill masquerades as a game AI guide, so users may not expect shell access to be used, enabling command execution under a low-suspicion workflow.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Referencing API keys or access credentials without a clear privacy warning normalizes handling of secrets without telling users how they will be protected. This can lead users to paste sensitive credentials into the skill context, where they may be exposed in logs, prompts, or downstream tool output.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.