T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:157- Finding
Untrusted Firebase Game State Controls On-Chain Wager Settlement
- Content
View full analysis
- Remediation
View remediation
Security audit
Lawb Chess
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its wagered chess purpose, but it deserves review because it can guide an agent to approve token spending and settle wagers from mutable Firebase game data.
Install only if you are comfortable with an agent interacting with a wallet, approving token transfers, writing wallet-linked data to Firebase, and submitting wager transactions. Require explicit confirmation for chain, contract, token, wager, approval amount, and settlement winner, and do not rely on Firebase alone to decide payouts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
Tournament Chat
Post messages to the public chess chat:
text chess_chat/public/messages/{push}
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs agents to create and join on-chain wagered games, approve ERC20 transfers, and claim pots without prominent warnings about irreversible blockchain transactions, token approvals, loss of funds, or jurisdiction/compliance concerns. An agent following this guidance could commit real assets or grant spending approvals without adequate user consent or risk acknowledgement.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill tells users to post wallet-linked chat messages, including walletAddress and displayName, to public and private Firebase paths without warning that this creates persistent, linkable identity metadata. This can expose users to tracking, profiling, spam, and correlation of wallet activity with chat behavior.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest scopes the skill to lawb chess gameplay, wagers, tournaments, and spectating on the specified platform. Recommending integration with external UCI engines and third-party cloud APIs adds broader chess-analysis/network capabilities that are not necessary to fulfill the platform-specific purpose described in the manifest.
- Content
Static analysis
No suspicious patterns detected.