Chinese Chess

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:54 AM UTC
• Version: 1.0.0

Overview

This skill is for making Chinese chess games, but it directs the agent to read and copy all files from unaudited absolute local directories before the user reviews the changes.

Review this skill carefully before installing. It does not appear to contain a payload itself, but it can cause an agent to ingest and copy whatever is in two local directories on the machine. Only use it if those directories are trusted, reviewed templates and you are comfortable with the agent modifying the target project from them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:18
• Finding: Unscoped Access to and Reuse of External Source Directories## Vulnerability Details **File Location**: `SKILL.md`, lines 18–54 **Vulnerability Type**: Unrestricted external directory access and unvalidated source reuse **Risk Level**: Medium ### Vulnerable Code ```markdown → Use source code from `/Users/root009/projects/demos/g1/game2` **Improve the game** — user says things like: - "improve the chess game" - "better UI/UX for the chess" - "enhance the game experience" - "make the game feel better" → Use source code from `/Users/root009/projects/demos/g2/game2` ## Workflow ### Step 1: Identify the intent | User intent | Source to use | |---|---| | Generate / create / build a new game | `/Users/root009/projects/demos/g1/game2` | | Improve / enhance / better experience | `/Users/root009/projects/demos/g2/game2` | ### Step 2: Read the source directory Read all files in the appropriate directory before doing anything else: ``` # For new game generation Read all files under /Users/root009/projects/demos/g1/game2 # For game improvement Read all files under /Users/root009/projects/demos/g2/game2 ``` Use `Glob` to list files, then `Read` to read each one. ### Step 3: Apply the source - Use the source code **directly** — do not rewrite from scratch. - Copy structure, logic, and patterns from the directory. - Only adapt what is strictly necessary for the user's context (target directory, filenames, etc.). ``` ### Technical Analysis The skill directs the agent to enumerate and read every file in one of two absolute, machine-specific directories outside the audited skill package. It then requires the contents to be reused directly. There is no file allowlist, source-integrity check, provenance verification, symlink restriction, sensitive-file exclusion, or review step before the external content is incorporated into a user project. The referenced directories are not part of the audited artifact, which contains only `SKILL.md`. Their contents and ...[truncated 2518 chars]
• Remediation: ## Remediation Suggestions 1. Package reviewed Chinese-chess templates within the skill artifact instead of relying on absolute directories outside the package. 2. Replace “read all files” with an explicit allowlist of required relative paths and permitted source extensions. 3. Resolve and canonicalize each path before access, verify that it remains beneath the approved template root, and reject symlinks or path escapes. 4. Exclude secrets, environment files, credentials, version-control metadata, build output, dependency trees, temporary files, and other unrelated content. 5. Verify template provenance and integrity through reviewed version control and pinned hashes or signed releases. 6. Inspect and summarize selected files before copying them. Require explicit approval before incorporating executable scripts, dependency manifests, build hooks, or configuration capable of running commands. 7. Copy only the files necessary for the requested functionality rather than mirroring the entire directory. 8. Use portable project-relative paths and fail safely if the trusted template is unavailable instead of searching or substituting arbitrary local content. 9. Correct the contradictory source mappings in the “Common Mistakes” table so the selected source cannot vary because of inconsistent instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The improvement triggers are broad enough that ordinary game-design or UX requests could activate this skill and route the agent into copying code from a fixed local directory. That creates a prompt-scope mismatch where user requests for advice or limited edits may instead cause unintended source ingestion and code reuse, increasing the chance of unauthorized file access or inappropriate code application.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly tells the agent to use local source code directly and only adapt it as needed, but does not require prior user consent for copying, creating, or modifying files. Combined with the earlier instruction to read all files from absolute local paths, this can lead to unintended propagation of unreviewed code and silent workspace changes sourced from potentially sensitive or unsafe local content.

Static analysis

No suspicious patterns detected.