Game Changing Features

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:40 PM UTC
• Version: 0.1.0

Overview

The skill is mostly a product-strategy template, but it unnecessarily injects an executable unpinned install command into generated strategy reports.

Review this skill before installing because it may cause generated strategy documents to include an unnecessary npx install command. Do not run the documented npx commands in sensitive environments unless you verify the package source, pin versions or commits, and are comfortable with local file creation under .claude/docs/ai.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:126
• Finding: Executable Installation Command Injected into Mandatory Strategy Output## Vulnerability Details **File Location**: `SKILL.md`, lines 126-153 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## Output Format ```markdown # 10x Analysis: <Product/Area> Session N | Date: YYYY-MM-DD ## Current Value What the product does today and for whom. ## The Question What would make this 10x more valuable? ## Installation ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install game-changing-features ``` ``` ### Technical Analysis The skill requires responses to follow a strategy-report template, but that template includes an executable package-installation command. Installation instructions are unrelated to the requested product analysis and cause the agent to promote external code execution whenever it follows the mandatory output format. This constitutes instruction hijacking because loading the skill alters the expected strategy response by injecting an operational command into generated artifacts. The command is not automatically executed by the skill, so exploitation requires the user or another automation layer to run it. ### Attack Path 1. A user loads the skill to perform product-strategy analysis. 2. The agent follows the mandatory output template in `SKILL.md`. 3. The generated strategy document includes `npx clawhub@latest install game-changing-features`. 4. The user or a downstream process treats the command as a recommended setup step. 5. Running the command downloads and executes code that was not part of the audited strategy output. ### Impact Assessment The direct impact is unauthorized promotion of an executable command in otherwise non-executable strategy content. If a user runs the command, the retrieved package executes with the privileges of that user and may access files, environment variables, network resources, and credentials available to the process. The a ...[truncated 215 chars]
• Remediation: ## Remediation Suggestions 1. Remove the installation section from the mandatory strategy-output template. 2. Keep installation documentation exclusively in `README.md` or another clearly separated setup document. 3. Do not include executable commands in generated reports unless the user explicitly requests installation instructions. 4. Add a rule prohibiting the skill from recommending package execution as part of ordinary product-strategy output. 5. If installation guidance is necessary, describe the package source, pinned version, integrity-verification procedure, and security implications.

T08 · Insecure Dependencies

Error

• Location: README.md:26
• Finding: Unpinned Remote Packages Executed Through npx## Vulnerability Details **File Locations**: `README.md`, lines 26-34; `SKILL.md`, lines 146-152 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: High **Vulnerable Code Snippet from `README.md`**: ```markdown ## Installation ```bash npx add https://github.com/wpank/ai/tree/main/skills/writing/game-changing-features ``` ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install game-changing-features ``` ``` **Corroborating Code Snippet from `SKILL.md`**: ```markdown ## Installation ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install game-changing-features ``` ``` ### Technical Analysis Both installation methods rely on mutable third-party sources: - `clawhub@latest` explicitly resolves to whichever package version is currently tagged `latest`. - The GitHub URL refers to mutable upstream repository content rather than an immutable commit. - No package digest, lockfile, integrity hash, signature-verification procedure, or fixed version is provided. `npx` can download and execute package code, including CLI entry points and package lifecycle behavior. Consequently, the code executed at installation time can differ from the repository contents reviewed during this audit. An upstream compromise, malicious package release, account takeover, or unsafe dependency update could therefore convert the documented installation path into arbitrary local code execution. ### Attack Path 1. An attacker compromises the package publisher, registry release process, GitHub repository, or a transitive dependency. 2. The attacker publishes malicious code under the mutable `latest` tag or changes content reachable through the documented GitHub source. 3. A user follows the installation instructions. 4. `npx` retrieves the current remote package and its dependencies. 5. The downloaded CLI or lifecycle code executes under the user's account. 6. The malicious code ...[truncated 842 chars]
• Remediation: ## Remediation Suggestions 1. Replace `clawhub@latest` with a reviewed, exact package version. 2. Reference an immutable Git commit rather than a mutable GitHub branch or directory URL. 3. Publish and verify cryptographic integrity hashes or trusted signatures for installation artifacts. 4. Use a lockfile where applicable and review all transitive dependencies. 5. Disable package lifecycle scripts during inspection or installation when they are unnecessary. 6. Document the expected publisher identity and provide a verification process before execution. 7. Download and inspect installation artifacts before running them in sensitive environments. 8. Perform installation in a sandbox or least-privileged environment without production credentials. 9. Remove the `npx` command from `SKILL.md`; installation guidance should not be emitted in normal strategy reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/writing/game-changing-features .cursor/skills/game-changing-features
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/writing/game-changing-features .claude/skills/game-changing-features
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/writing/game-changing-features ~/.claude/skills/game-changing-features
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: game-changing-features
model: reasoning
version: 1.0.0
description: >
  Find 10x product opportunities and high-leverage improvements. Use when the user wants

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill includes an install command using `npx clawhub@latest`, which pulls and executes the latest remote package version without pinning. That creates a supply-chain risk: a compromised or maliciously updated package could run arbitrary code on the user's system when they follow the documented installation instructions.

Vague Triggers

Low

• Confidence: 88% confidence
• Finding: The 'When to Use' section describes activation in broad terms such as 'User wants strategic product thinking' and 'Before major feature planning sessions' without clear boundaries or exclusion conditions. These phrases could overlap with many ordinary product conversations, increasing the chance of unintended invocation.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The manifest frames this skill as product strategy and ideation, which is primarily analytical. However, the instructions explicitly require writing responses to `.claude/docs/ai/<product-or-area>/10x/session-N.md`, adding a file-writing behavior not disclosed in the manifest description.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The markdown explicitly directs the skill to write all responses to a filesystem path, which is a data-affecting operation. The document does not include any warning about file creation, overwrite risk, or obtaining user confirmation before writing.

Static analysis

No suspicious patterns detected.