openplanet-plugin-dev

• Outcome: Review
• Latest audit: Aug 17, 2026 · 12:15 PM UTC
• Version: 3.0.0

Overview

This is a coherent Openplanet plugin-development skill, but it includes broad game-memory, native-DLL, process-control, and destructive maintenance guidance that should be reviewed before use.

Install only if you want an advanced Openplanet development reference and are comfortable reviewing generated code before running it. Treat trainer, memory-offset, hook, native DLL, bulk-delete, plugin-moving, registry, and force-kill instructions as high-risk operations; use them only in controlled development/offline contexts, keep backups, and avoid sending private game/account/map data to third-party APIs without explicit consent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The reference explicitly guides users toward teleport restore and Tier-2 velocity restore via `Dev::SetOffset`, which moves beyond ordinary plugin scaffolding into game-state manipulation and memory-offset writing. In a plugin-development skill, that materially increases the chance an agent will generate unsafe or integrity-impacting code, especially because offset-based writes are fragile, version-dependent, and can bypass normal API safety boundaries.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section exposes powerful memory patching, hooking, and arbitrary read/write primitives that can be used to tamper with game code or other process memory. In an agent skill intended to help write plugins, giving easy access to these capabilities materially increases the chance the agent will generate cheat-enabling, destabilizing, or system-unsafe instructions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: DLL loading and external symbol import enable execution paths outside the normal plugin sandbox and can be used to bridge into arbitrary native code. In the context of an agent skill, this creates a realistic path for generating unsafe guidance that facilitates persistence, evasion, or broader host compromise.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Filesystem mutation APIs and process-control functions such as immediate termination can be abused to delete, move, or overwrite files and disrupt application state. Within an agent skill, exposing these capabilities without restrictive context increases the risk of harmful code generation or destructive troubleshooting advice.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill instructs the user to run `taskkill /F /IM ManiaPlanet.exe` as part of the edit/relaunch workflow, but does not prominently warn that this forcibly terminates the game process and can discard unsaved work. In a developer-assistant context, users may copy commands verbatim, making accidental data loss or disruption plausible.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation recommends `taskkill /F /IM ManiaPlanet.exe`, which force-terminates the process and can cause loss of unsaved state or corruption of in-progress files if used carelessly. In a developer workflow this may be sometimes necessary, but presenting it without a prominent warning or safer alternatives increases the chance of destructive misuse.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The command truncates `Openplanet.log` before verification, permanently erasing prior diagnostic history. While useful for obtaining a clean test run, doing so without a clear warning can cause accidental loss of troubleshooting evidence that may be needed later.

Missing User Warnings

High

• Confidence: 77% confidence
• Finding: The document enumerates destructive bulk deletion operations such as `RemoveAllBlocks()`, `RemoveAllObjects()`, `RemoveAllTerrain()`, and `RemoveAll()` without any warning that they can irreversibly modify or wipe user map content. In a plugin-development context, this can normalize unsafe use of high-impact editor APIs and lead downstream authors to build tools that destroy data without confirmation or undo guidance.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The file explicitly recommends force-killing the ManiaPlanet process and later clearing the Openplanet log as part of routine workflow, but it does so without clear warnings about data loss, unsaved editor state, or forensic/log-destruction consequences. In a developer skill that may be followed verbatim by an automated or semi-automated agent, these commands can cause accidental loss of work and removal of diagnostic evidence.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The markdown describes teleport and memory-offset restore capabilities as normal project milestones without any explicit warning that they can violate game integrity expectations, break across updates, or encourage unsafe low-level writes. Presenting these capabilities without safety framing makes it more likely an agent or user will treat them as routine and generate risky manipulation features.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation tells users to bypass SmartScreen and run an unsigned installer after antivirus warnings, framing alerts as false positives without independent verification steps. This normalizes overriding host security controls and could condition users or an agent to disregard legitimate malware warnings.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The text instructs users to install a registry file to enable crash dumps without describing the security and stability implications of modifying the Windows registry. Registry changes can have system-wide effects, and normalization of such edits is unsafe in a broadly scoped agent skill.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The reference discusses sending JSON to external APIs but does not include a clear privacy or data-handling warning. In a development skill, that omission can normalize network integrations without reminding users that prompts, telemetry, map data, or other plugin data may be transmitted to third-party services.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This is a true positive: the file contains bulk `mv -f` recipes that relocate plugin directories en masse, which can disable plugins, overwrite state, or create confusing duplicate-load behavior if used incorrectly. Although a backup step is included, the commands are still destructive operational guidance and the document does not give an explicit warning about plugin availability, state loss risk, or the need to verify targets before execution.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.