Security audit

游戏开发助手免费版

Security checks across malware telemetry and agentic risk

Overview

This is a game-development guidance skill with broad but visible read/write/exec capability and no evidence of hidden, destructive, or exfiltrating behavior.

Install this as a game-development helper, not as a general-purpose operations tool. Before letting it run shell commands or write files, confirm the target project directory and review any reset, import, export, or save action that could overwrite existing work.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document presents the skill as a pure Markdown/local-guidance tool that does not need external API keys, but the manifest enables executable tooling and the content includes shell commands users may run directly. This mismatch can cause operators to trust the skill as low-risk documentation when it can in fact affect the local system or project files, increasing the chance of unsafe execution without proper review.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill states it is not suitable for operations/deployment management, yet it also says to use it for development deployment and includes deployment-oriented guidance. This inconsistency can lead users or orchestrators to invoke the skill in contexts it claims to avoid, weakening safety boundaries and causing actions outside the intended scope.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The top-level description is broad enough to match many generic coding, debugging, testing, and deployment requests. Over-broad routing increases the likelihood that this skill is auto-invoked for tasks involving sensitive repositories or command execution, even when a narrower or safer skill should handle them.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation condition says to use the skill whenever code generation, programming assistance, debugging, testing, or deployment is needed, which lacks meaningful constraints. Such vague activation criteria make accidental invocation more likely in high-privilege contexts where the skill's declared tools could read, write, or execute on local resources.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises create/query/export, modify/reset/import, and save/convert operations without clear warnings that these may change local files or project state. In combination with declared write/exec capabilities, this can mislead users into treating the actions as harmless formatting or analysis steps when they may overwrite data or alter repositories.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.