Security audit

2037

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Earth2037 game-control skill, but it handles credentials and can perform broad account-changing game actions without enough scoping or safeguards.

Install only if you intend to let this skill operate your Earth2037 account, not just register or log in. Avoid putting passwords or keys directly in command arguments, do not set a custom apiBase unless you trust it, keep the skill directory private, and require explicit approval before chat posts, troop movement, construction, recruitment, inventory discard/disassembly, or cache sync/bootstrap.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: 2037.py:27
Finding: Credential and bearer-token transmission to unrestricted API endpoints
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: 2037.py:423
Finding: Passwords and registration keys exposed through process arguments
Content: View full analysis
<密码>") sys.exit(1) cmd_recover(api_base, args[1], args[2]) elif cmd == "login": if len(args) < 3: print("用法: 2037.py login <用户名> <密码>") sys.exit(1) cmd_login(api_base, args[1], args[2]) elif cmd == "apply": if len(args) < 4: print("用法: 2037.py apply <用户名> <密码> [种族]") sys.exit(1) tribe_id = args[4] if len(args) > 4 else None cmd_apply(api_base, args[1], args[2], args[3], tribe_id=tribe_id) ``` The documentation explicitly directs users and Agents to invoke these commands with secrets embedded in the command line: ```text 2037 login X Y 2037 apply with key 2037 recover key (have account, no SK-key) ``` ### Technical Analysis The CLI obtains passwords and registration keys from `sys.argv`. Process arguments are not an appropriate secret channel because they can be retained or exposed by: - Shell command history - Process-listing interfaces available to other local processes - Terminal capture and session logging - Agent tool-call logs and execution telemetry - Debugging, auditing, or orchestration systems that record commands The password is not printed directly by the code, but placing it in argv exposes it before the request is made. The Skill documentation makes this the normal authentication workflow rather than an exceptional compatibility mode. ### Attack Path 1. A user or Agent follows the documented login, apply, recover, or registration command. 2. The password or key becomes part of the process command line. 3. The command is stored in shell history, Agent logs, orchestration logs, or a process-listing interface. 4. A local user, monitoring process, or log reader o ...[truncated 434 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: cache.py:250
Finding: Sensitive account and session caches are created without explicit restrictive permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: build_ops.py:92
Finding: Unrestricted file-backed payloads can transmit arbitrary readable local files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documentation includes troop recruitment queue management and other low-level operational helpers that exceed the declared key/register/login purpose. Recruitment changes in-game state and consumes resources, so concealing it behind an underspecified description increases the chance of unsafe delegation or accidental misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation includes troop recruitment queue management and other low-level operational helpers that exceed the declared key/register/login purpose. Recruitment changes in-game state and consumes resources, so concealing it behind an underspecified description increases the chance of unsafe delegation or accidental misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation includes troop recruitment queue management and other low-level operational helpers that exceed the declared key/register/login purpose. Recruitment changes in-game state and consumes resources, so concealing it behind an underspecified description increases the chance of unsafe delegation or accidental misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documentation includes troop recruitment queue management and other low-level operational helpers that exceed the declared key/register/login purpose. Recruitment changes in-game state and consumes resources, so concealing it behind an underspecified description increases the chance of unsafe delegation or accidental misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation includes troop recruitment queue management and other low-level operational helpers that exceed the declared key/register/login purpose. Recruitment changes in-game state and consumes resources, so concealing it behind an underspecified description increases the chance of unsafe delegation or accidental misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation includes troop recruitment queue management and other low-level operational helpers that exceed the declared key/register/login purpose. Recruitment changes in-game state and consumes resources, so concealing it behind an underspecified description increases the chance of unsafe delegation or accidental misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation includes troop recruitment queue management and other low-level operational helpers that exceed the declared key/register/login purpose. Recruitment changes in-game state and consumes resources, so concealing it behind an underspecified description increases the chance of unsafe delegation or accidental misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python skill's docstring and all user-facing prompts and status messages are written in Chinese, and the --lang option only affects server selection rather than output language. That creates a locale-policy concern because the skill effectively imposes a specific language on users without opt-in or an alternative.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The recover command allows credential-based recovery of a long-lived skill token using only username and password, even though the manifest does not disclose this capability. In an agent setting, this increases the sensitivity of handling raw credentials and can let the skill mint or recover reusable API access beyond the narrow login flow a user may think they are invoking.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill metadata says it should be used for key/apikey, registration, and login, but the CLI also exposes authenticated gameplay/state-changing actions like setcity, airdrop, sync, and bootstrap. This mismatch is dangerous because it broadens the skill's real authority beyond what users, reviewers, or orchestrators may expect, enabling unexpected account-affecting actions once a token is present.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file points the agent to build, march, and chat operations and frames them as normal next steps, but does not warn that these commands can modify live game state, spend resources, move units, or send messages on behalf of the user. In a skill intended for LLM use, that omission can lead to unauthorized or accidental state-changing actions if the agent acts without explicit confirmation.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · MAP_FOR_AI.md (reported line 113)May include surrounding context.
md
| `skills/earth2037-game/build_ops.py` | 升级 / 取消队列 | | `skills/earth2037-game/march_ops.py` | 出征 | | `skills/earth2037-game/chat_ops.py` | 世界/联盟聊天 | | `skills/earth2037-game/SKILL.md` | 完整命令与 HTTP 约定 | ---

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares broad operational capabilities—shell, network, file read/write, and environment access—without any explicit tool-scoping or permission boundaries in the manifest. In practice this increases risk because the skill instructs immediate command execution, handles credentials/tokens, writes local cache files, and performs authenticated remote actions, yet gives the host no least-privilege constraints to enforce.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says the skill is mainly for key/register/login flows, while the body documents broad authenticated game control and state-management behavior. This is a real security issue because it undermines informed consent and makes policy or human review likely to underestimate the skill's reach.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill tells the agent to immediately execute account-related commands but does not warn that usernames, passwords, keys, and bearer tokens will be sent to a remote API and that account/session data may be cached locally. That lack of disclosure is dangerous because it can trick users into sharing sensitive credentials without informed consent and expands exposure through local persistence.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Social/chat and alliance capabilities are unrelated to the manifest's narrow authentication-focused purpose and enable authenticated interactions with other users. Because these are externally visible actions, undocumented support for reading and sending messages raises impersonation, spam, and abuse risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation includes destructive inventory actions such as dropping and disassembling items, despite a manifest centered on key/register/login. These operations can irreversibly destroy in-game assets, making the mismatch particularly dangerous because a user may grant trust to an auth helper that can actually perform loss-causing actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains user-facing natural-language strings entirely in Chinese, including the top-level description and command-line help, with no indication that the skill is intentionally region-specific or that users may select another language. That creates a language/locale policy concern under the rule for natural-language policy violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code exposes a cancel-queue command that invokes CANCELBUILDQUEUE, which can irreversibly alter in-game state, but there is no confirmation prompt or user-facing warning before execution. The brief help text only names the command and does not disclose that it performs a destructive cancellation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code performs authenticated HTTP requests to remote endpoints and writes the returned multi-route game data into local JSON cache files. Although the module docstring mentions local caching in general, the bootstrap path itself lacks an in-function confirmation or explicit user-facing disclosure at the point where sensitive account/game data is fetched and persisted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code's user-facing natural language is entirely in Chinese, beginning with the module description and continuing through command descriptions and error messages. Under the policy, forcing a specific language without user opt-in or a documented justified locale scope is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The configuration defines separate API bases for "zh" and "en", which indicates the skill routes behavior based on language/locale. There is no visible indication in this file that users can opt in to that locale handling or that the restriction is documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This Python file exposes a raw-json mode that accepts an entire CombatQueue JSON payload and later transmits it via gc(api, token, "ADDCOMBATQUEUE", line). While the script's overall purpose is game marching, this mode lacks any confirmation prompt or explicit user-facing warning near the interface that it will submit arbitrary queued actions to the remote API.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-level docstring is entirely in Chinese and presents the skill’s commands and usage only in that language. This is a natural-language locale constraint with no indication that the user can choose another language or that the restriction is justified by a region-specific requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document instructs authenticated HTTP use with a Bearer token and references environment/config token sources, but does not warn that these credentials grant access to a live game account and may expose user data or permit actions under that account. In an agent/skill context, omission of credential-handling guidance increases the chance of unsafe token use, logging, or unintended access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.