Security audit

Text Game Arcade Tool Free

Security checks across malware telemetry and agentic risk

Overview

This text-game skill mostly matches its stated purpose, but it requests broad command-execution authority and contains mismatched trigger and data-flow wording that users should review before installing.

Review this skill before installing. It is not malicious from the inspected artifact, but only install it if you are comfortable granting shell-command capability to a text-game helper. Treat generated story text and player inputs as potentially visible to the agent's LLM provider, and check or disable auto-save if you do not want game content written under ~/.text-game/saves.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill is presented as a local/offline single-user text-game generator, but it exposes a generic exec capability without narrowing it to game-specific commands. That creates a privilege/expectation mismatch: an agent may execute arbitrary shell commands under the guise of harmless entertainment functionality, increasing the risk of file tampering, data exposure, or command abuse.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The documentation inconsistently claims both 'no external API key/local inference' and that an LLM API is required. This can mislead operators about the trust boundary and data flow, causing them to provide sensitive prompts or content under the false assumption nothing leaves the machine.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger conditions mention unrelated scenarios like UI design, poster creation, and brand visuals, which do not match a text-game skill. Overbroad and mismatched activation rules can cause the skill to be invoked in unintended contexts, especially dangerous here because the skill also advertises exec and file operations.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill describes save/export operations but does not clearly warn that these actions persist data to local files. Users may disclose private story content or personal inputs without understanding that the data will be retained on disk, creating privacy and data-retention risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The configuration example enables auto-save and an interval-based save policy but does not warn that this will repeatedly write user content to local storage. Continuous background persistence increases the chance of storing sensitive prompts, personal writing, or other private content without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.