Security audit

游戏开发助手免费版

Security checks for vulnerabilities and agentic risk

Overview

This game-development helper is mostly guidance-oriented, but it asks for command and file-write authority with broad and partly inconsistent scope, so users should review it before installing.

Install only if you are comfortable with a game-development assistant that may run commands and possibly write files. Treat the shell and CI snippets as examples to approve manually, narrow use to explicit game-development tasks, and pin any copied GitHub Actions to reviewed commit SHAs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:404
Finding: GitHub Actions Dependencies Are Not Pinned to Immutable Commit SHAs
Content: View full analysis
Remediation: View remediation
- name: Setup Godot uses: chickensoft-games/setup-godot@ ``` 2. Retain the release version in a comment for maintainability, for example: ```yaml - uses: actions/checkout@ # v4.x ``` 3. Review the source, ownership, release history, and security posture of third-party actions before approving their commit SHAs. 4. Use Dependabot or an equivalent controlled update process to propose action SHA updates, and require review before merging them. 5. Declare minimal workflow permissions explicitly, such as: ```yaml permissions: contents: read ``` 6. Grant write permissions only to jobs that demonstrably require them, and isolate release or deployment jobs from ordinary build and pull-request jobs. 7. Do not expose repository or deployment secrets to workflows triggered by untrusted pull requests. 8. Protect release environments with approval gates, branch protections, artifact verification, and provenance or signature checks. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger language is overly broad and overlaps with common development requests such as coding help, debugging, testing, and deployment. In an agent ecosystem, this can cause the skill to activate in many unrelated situations and inherit tool privileges like exec/write more often than necessary, expanding attack surface and the chance of unintended command or file actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description states '支持中文交互' as part of the skill behavior, and the document is written entirely in Chinese without offering a language choice. This can constitute a language/locale policy issue because it implies a fixed interaction language rather than user selection or explicit regional scoping.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The keyword-based scope statement is excessively vague and effectively claims coverage over a wide set of loosely related terms. That makes accidental or inappropriate activation more likely, especially dangerous here because the skill has read/exec/write permissions that could be invoked in contexts the user did not intend.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The usage example states "运维部署管理" is not suitable for this skill, while the manifest description says to use it for "开发部署". These statements actively contradict each other about whether deployment-related work is within scope, creating intent ambiguity for operators and users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation includes commands that create directories, change working directories, and write files, but it does not prominently warn users that running them will alter the filesystem. In a skill with exec/write capability, this can lead to unexpected local changes, overwriting content, or normalized agent behavior where side effects happen without informed consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill presents itself as a pure Markdown guidance/template skill, but its manifest enables read/exec/write capabilities. This mismatch can cause an agent or user to trust the skill as documentation-only while it is actually authorized to modify files or run commands, increasing the risk of unintended side effects or abuse.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The API key section says the free version needs no external API key and that guidance is provided locally by the agent LLM, implying a self-contained advisory skill. Later sections discuss network errors, ping-based connectivity checks, and HTTPS communication safety as operational considerations, which conflicts with the earlier portrayal of purely local guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.