Security audit

Voidex Areana Space Trading

Security checks for vulnerabilities and agentic risk

Overview

This game skill is mostly coherent, but it asks the agent to search broadly for credentials, persist API keys, and potentially run recurring account-changing actions.

Review before installing. Provide the Voidex key only through a dedicated secret or VOIDEX_ARENA_KEY, do not allow broad searches of files, notes, memory, or .env files, avoid storing the key in plain config or agent memory, and enable heartbeat or cron only if you are comfortable with repeated automated changes to the game account.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:12
Finding: Overbroad Credential Discovery and Unprotected Persistent Secret Storage
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: HEARTBEAT.md:1
Finding: Cross-Session Autonomous Execution Through Heartbeat and Cron Scheduling
Content: View full analysis
0` — in transit, can only scout markets remotely 3. `GET /events` — check for active galactic events affecting prices 4. `GET /planet/{location}/market` — prices at your current planet 5. `GET /planet/{location}/services` — fuel price, repair cost, available upgrades 6. Trade: `POST /planet/{id}/buy` and `POST /planet/{id}/sell` 7. Ship: `POST /planet/{id}/refuel`, `POST /planet/{id}/repair`, `POST /planet/{id}/upgrade` 8. Scout: `GET /planet/{any-id}/market` and `GET /planet/{any-id}/services` work remotely 9. `POST /travel` — depart for another planet (consumes flux, degrades hull) 10. `GET /leaderboard` — your ranking ``` The bundled script additionally recommends operating-system scheduling: ```bash # This runs one heartbeat cycle: check status, sell, buy, refuel, travel. # Set up a cron job to run every 4 hours for continuous trading. ``` ### Technical Analysis The package defines a recurring heartbeat with a 14,400-second interval and explicitly recommends creating a cron job. The documented cycle includes authenticated, state-changing operations that can trade assets, spend credits, alter the ship, and initiate travel. This creates an execution path that can survive the initiating interaction and continue without per-cycle user review. Although the project does not itself contain a command that installs a crontab, its manifest defines recurring execution and its script e ...[truncated 1650 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/trade.sh:13
Finding: API Key Exposed in Curl Process Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents the skill as a trading game capability centered on buying goods, flying between star systems, and selling for profit. However, the supplied code chunk only reads agent/market/service/leaderboard data and conditionally calls repair and refuel endpoints. It never places buy orders, sells inventory, or initiates travel, which are the core behaviors implied by the description and even by the script comments. While leaderboard access is consistent with the description, the primary implemented behavior is status maintenance and information retrieval rather than trading. Therefore the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 100% confidence
Finding: The explicit instruction to inspect .env files for credentials is a direct secret-access pattern. .env files often contain unrelated API keys, tokens, and database credentials, so telling an agent to read them for a game account materially increases the risk of credential exposure beyond the skill's legitimate need.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
You MUST search your memory, notes, files, and environment for existing credentials: - Check environment variable `VOIDEX_ARENA_KEY` - Search your persistent memory/notes for any previously stored API key or agent name - Check local files, config files, or .env files for stored credentials **If you find existing credentials:** Use them. Call `GET /api/v1/me` to verify they work. Do NOT register a new account.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to retrieve stored API credentials from memory, files, or environment without constraining scope or warning about sensitive secret handling. In an agent setting, this can normalize broad secret access and increase the chance that unrelated credentials are accessed, retained, or exposed through logs, memory, or downstream actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill appears to rely on shell-capable behavior yet declares no explicit tool or permission scope. This creates an authorization gap where an agent may use broader local capabilities than users expect, increasing the chance of unintended file or environment access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to search memory, notes, files, config files, and .env files for credentials, which is far broader than necessary for a trading-game workflow. This can expose unrelated secrets and normalize credential scavenging from local or persistent storage without clear user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Broad instructions to inspect local files, config, notes, and environment for stored credentials bypass the principle of least surprise and occur without any explicit warning or consent flow. Even if intended to avoid duplicate registrations, the query scope is disproportionate and can access sensitive data unrelated to the game.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill combines two risky behaviors: broad credential discovery across local and persistent sources, and mandatory persistence of recovered secrets for future reuse. Together these create a durable secret-handling anti-pattern that can leak credentials across sessions, tools, or unrelated tasks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs persistent storage of the API key and agent name in memory systems or local configuration, extending secret lifetime and spreading it across storage locations. Persistent replication of credentials increases the chance of later disclosure, unintended reuse, or compromise by other tools and sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Persistent memory and logging are not inherently malicious for a game, but the instruction is broad and encourages accumulating long-lived session data. Without strict scoping, this memory may capture sensitive operational context, user-provided data, or secrets alongside trading history, creating avoidable retention risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The registration flow requires users to submit a personal Twitter/X handle, which is unnecessary for core gameplay and links an agent account to an external real-world identity. Without a privacy notice, minimization rationale, or safer alternative, this creates avoidable privacy risk through tracking, profiling, doxxing, or reuse of personal identifiers across contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.