Security audit

Agent Rpg

Security checks for vulnerabilities and agentic risk

Overview

This RPG skill mostly matches its stated purpose, but it needs Review because its save-file script can access files outside the intended campaign folder and its dice roller lacks resource limits.

Review before installing. Use only simple campaign names such as letters, numbers, hyphens, or underscores, and avoid saving sensitive personal content because campaign state is written to disk. The publisher should add path validation, dice limits, clear opt-in and deletion instructions, and remove or gate the adult-roleplay guidance.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/context.py:9
Finding: Path Traversal Through Unvalidated Campaign Names
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dice.py:9
Finding: Denial of Service Through Unbounded Dice Expressions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code substantially supports the 'persistent memory' portion of the description by creating and updating campaign files for world state, character state, inventory, flags, and a journal. However, the declared purpose is broader and centers on transforming the agent into a versatile RPG Game Master with dice rolling and consequence management. This code chunk does not perform any GM-style orchestration, storytelling, rule adjudication, or dice/randomization. Its primary behavior is a file-backed state/context manager, not a full RPG GM skill. There is no concerning undeclared exfiltration or unrelated capability; the mismatch is that the implementation is materially narrower than the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a full RPG GM system with persistent memory, state management tools, and narrative consequence management across arbitrary settings. The supplied code only implements a local dice-rolling utility. It can parse expressions like XdY+Z and pbta+Z, handle advantage/disadvantage, and report crits or PbtA result tiers, but it does not manage game state, store memory, run roleplay scenes, or act as a GM. This is a material description-behavior mismatch because the primary purpose is much narrower than declared.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to use local scripts that read and write persistent campaign files, but it does not declare any tool scope or permission boundary. That creates an undeclared capability surface where file operations may occur without explicit least-privilege constraints, increasing the chance of unintended persistence or misuse if the skill is invoked broadly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invocation guidance is broad enough that the skill could activate in many loosely related conversations, including ones where persistent memory or file-backed state is unnecessary. Broad trigger conditions increase the risk of accidental tool use, unnecessary state creation, and unexpected data retention in contexts where the user did not intend storage-backed gameplay features.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to store ongoing campaign data in filesystem-backed memory paths, including character sheets, NPC states, flags, and journals, without warning the user that their content will be persisted. This creates a privacy and consent issue because users may share sensitive or personal roleplay content without realizing it will be saved long-term.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file explicitly suggests using the skill for ERP ('pure roleplay or erp without math') without any opt-in, age-gating, or safety-policy framing. In an agent skill intended to shape model behavior, this can steer the agent toward sexual content generation in ordinary usage, increasing the likelihood of policy-violating or unsafe interactions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.