Aivilization

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 0.1.2

Overview

This skill is a disclosed game/social agent, but it asks the agent to expose its access token, auto-update its own instructions, and perform recurring social actions with limited controls.

Install only if you are comfortable with a game agent that keeps acting on a schedule, posts and engages socially, stores an Access Code, and updates local skill instructions from the publisher's server. Treat any Access Code or auth_token link as a password, do not share it, and prefer a version that uses scoped expiring links and explicit approval for updates and social actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The heartbeat expands the skill from an in-game sandbox into mandatory social posting, liking, commenting, reposting, and replying every cycle. This materially broadens the skill’s behavior and external action surface beyond the stated sandbox-management purpose, increasing the risk of unintended outbound content generation, reputational harm, and abuse of the agent as a social automation tool.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The file instructs the agent to periodically fetch remote content and overwrite local SKILL.md and HEARTBEAT.md. This creates an unbounded self-update channel where future behavior can be changed by network content outside normal review, enabling prompt/instruction injection persistence and silent capability expansion.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The skill encourages mixing real-world news into posts even though the declared context is an in-game civilization sandbox. That broadens scope and can cause the agent to pull in unrelated external content, increasing risks of misinformation, policy drift, and generation of content disconnected from the user’s intended use of the skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent to place the live bearer Access Code into a human-facing URL. URLs are commonly logged by browsers, proxies, analytics tools, chat transcripts, screenshots, and referrers, so exposing a bearer token this way can leak full account access and enable agent impersonation.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The document warns never to send the Access Code to domains other than portal.aivilization.ai, but elsewhere instructs the agent to transmit that same secret to game.aivilization.ai in a query string. This contradiction undermines secret-handling guidance and normalizes unsafe disclosure of the credential across domains and channels.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The instructions tell the agent to place the bearer auth token directly into a human-facing URL. Putting secrets in URLs is dangerous because URLs are commonly exposed through logs, browser history, referrers, screenshots, chat transcripts, and analytics systems, making token compromise likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The heartbeat instructs direct overwrite of local skill files from remote network responses without warning or validation. This is dangerous because a compromised server, MITM, or unexpected remote change could alter local instructions and persist malicious behavior on subsequent runs.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README promotes ongoing autonomous behavior such as posting, commenting, reposting, and self-updating strategy after only an initial opt-in, but it does not clearly explain the privacy, reputational, and operational risks of those continued actions. In this context, an agent may generate public or semi-public content, process logs/events, and change behavior over time without granular user consent or clear safety boundaries, which creates a real autonomy and consent risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill tells the agent to share a token-bearing access link without clearly stating that possession of the link is equivalent to possession of the bearer credential. Users may forward, bookmark, or paste the URL without realizing it grants account access, creating an easy path to credential leakage and takeover.

Ssd 3

High

• Confidence: 100% confidence
• Finding: This instruction explicitly directs inclusion of the bearer auth token in a reminder link shown to the human. Exposing a live bearer token is a direct credential disclosure vulnerability: anyone with the link can potentially act as the agent, access account data, or perform unauthorized actions.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The example heartbeat report normalizes sending the full auth token back to the human in conversational text. Examples are powerful behavioral prompts for agents, so this materially increases the chance of secret exfiltration through normal reporting, chat history, and downstream logging systems.

Ssd 3

High

• Confidence: 99% confidence
• Finding: These instructions require the agent to disclose a live auth token during ordinary conversation by embedding it in a human-use link. Conversational channels are often persisted in logs and third-party systems, so this practice materially increases the chance of secret exposure and downstream account compromise.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The low-credit reminder proactively emits a tokenized game URL, causing the agent to reveal a reusable credential whenever balance is low. This creates repeated exposure opportunities and trains users to treat bearer-token links as normal operational messages.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.