T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/common.py:44- Finding
Arbitrary Filesystem Access Through Unvalidated Game Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
Gamebox
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real multiplayer game skill, but it needs Review because its shared files and private game data are not safely scoped or access-controlled.
Install only for trusted local or sandboxed multi-agent play. Use a dedicated game directory with restrictive filesystem permissions, do not store secrets in messages or game state, and do not rely on the private or role channels against untrusted participants until path containment and authentication are added.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/manager.py:105- Finding
Caller-Supplied Usernames Allow Privileged Identity Spoofing
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/manager.py:203- Finding
Unauthenticated Game Information Endpoint Discloses Complete Secret State
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/message.py:84- Finding
Private and Role Message Channels Lack Access Control and Path Validation
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/message.py:68- Finding
Untrusted Callers Can Forge Authoritative System Messages
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents file read/write behavior through a shared game directory but does not declare any explicit tool scope, permissions, or operational boundaries. In an agent environment, this can lead to overbroad filesystem access assumptions and unsafe execution of file operations beyond the intended game state directory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly relies on shared-directory messaging, private/user channels, and persistent file storage, yet provides no warning about privacy, data leakage, or trust boundaries between participating agents. In multi-agent shared storage setups, sensitive messages or state can be exposed, tampered with, or misrouted if users assume the channels are inherently private.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill is written as a Chinese-only prompt template, including role instructions, request handling, and output templates, with no indication that users can choose another language. This creates a natural-language policy concern because it implicitly enforces a specific language/locale without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title and all operational instructions are written as a Chinese-language prompt template, which strongly implies the skill is intended to run in Chinese. The file does not offer user language selection or explain that the skill is region- or locale-specific, so it risks violating the language/locale policy for natural-language behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill is written as a Chinese-only prompt template, including all role instructions and user-facing interaction text such as the opening guidance. There is no indication that the user may choose another language or that the Chinese-only constraint is justified by a region-specific purpose, which creates a language/locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file contains all user-facing docstrings and error/output strings in Chinese only, including command descriptions and runtime messages. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
L094 的函数文档字符串明确写明“仅创建者或动作本人”可以撤销最近一条动作，但 L106-L108 的实际权限检查仅允许
user == meta["creator"]，并未实现“动作本人”可撤销。这里不是简单的文档不完整，而是权限语义上的直接矛盾，容易误导调用方对撤销能力和权限边界的理解。- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file contains user-visible and maintainer-facing natural-language text exclusively in Chinese, including module docstrings, function docstrings, comments, and error messages. Under the policy, forcing a specific language without opt-in or documented justification is a locale/language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The top-level docstring presents the skill entirely in Chinese ("小说接龙 — 多人协作创作，LLM 调和风格") with no indication that language is selectable or that the skill is intentionally region-specific. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module title is in Chinese and all user-facing strings throughout the skill are Chinese-only, indicating the skill is designed to operate in a fixed language. The file does not offer a language choice or document that the skill is intentionally region-specific, which can violate language/locale policy requirements.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # 加载对应游戏模块初始化状态 game_type = meta["type"] try: mod = __import__(f"games.{game_type}", fromlist=["init"]) init_data = mod.init(meta["players"], meta["config"]) except Exception as e: # 如果游戏模块不存在，使用默认空状态
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
When the last player leaves, the code deletes the entire game directory with shutil.rmtree. Although a success message is returned afterward, there is no prior warning, confirmation, or explanatory comment/docstring disclosing that leaving as the last player will permanently delete game data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code persists message content and recipient metadata into JSON files for private, role, and system channels, but the file does not provide any user-facing disclosure such as a confirmation prompt, log/print statement, or explanatory comments/docstrings that communicate that messages are being stored on disk. Because these writes involve user data and private-message records, they match the missing-warning criterion for code files.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The send API allows any caller to set msg_type to "system", which causes the message author to be rewritten as "system" without any authentication or authorization check. In a multi-agent game framework where messages drive player decisions and game state coordination, this enables spoofed authoritative announcements, social engineering, and potentially indirect manipulation of game flow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The receive path performs a filesystem write by creating '.read' marker files as a side effect of reading messages, but there is no visible disclosure to the user that receiving messages changes on-disk state. This is a safety-relevant file write because a nominally read-only action mutates stored message state silently.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Natural-language strings throughout the file, including the module docstring and all user-facing status/error messages, are written exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire prompt template is written in Chinese and specifies response patterns only in Chinese, with no indication that the user may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file contains a natural-language module docstring in Chinese: '游戏模块包 — 每个游戏独立文件，提供初始化/动作解析/胜负判定'. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation, and this file provides no indication that Chinese is optional or justified by a region-specific constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module title and all user-facing narrative/error strings in this skill are written in Chinese, indicating the skill operates in a fixed language. The file does not offer a language/locale option or document that it is intentionally region-specific, which matches the policy concern for forced language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module title and all user-facing strings in this file are written in Chinese, which effectively fixes the interaction language for users. The file does not provide any opt-in, locale selection, or justification for being Chinese-only, so it presents a language/locale policy concern under the natural-language policy rule.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstrings, comments, user-facing error messages, and narrative strings are all in Chinese, which effectively forces a specific language for interaction. The file does not indicate that this is an opt-in locale-specific skill or offer an alternative language choice.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
At L135 the inline docstring states '修改自己最近的段落' (revise your most recent segment). However, the implementation only checks that the indexed segment belongs to the user and does not verify that it is their latest contribution. This is an intent/documentation mismatch, though it appears limited to game semantics rather than a broader security impact.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The module title and all user-facing strings are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language context. This creates a natural-language locale constraint without explicit opt-in or justification.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The channels listing returns every role channel directory name to any caller, regardless of whether that user should know those roles exist. In games like Werewolf or hidden-role scenarios, merely revealing role-channel names can disclose secret game structure, faction presence, or privileged communication groups, undermining confidentiality and gameplay integrity.
- Content