Security audit

Game of Cards

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate workflow plugin, but it can automatically and silently create or update project task files and commits, so it belongs in Review before installation.

Install only if you want this plugin to become an active project workflow layer. Expect it to create and update .game-of-cards files, steer agents through a card-first process, and sometimes commit deck state automatically. Review the auto-commit, autonomy, and hook settings before enabling it in repositories where silent task tracking, automated queue draining, or agent-made commits would be surprising.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (32)

Vague Triggers

High

Confidence: 94% confidence
Finding: The skill declares auto-invocation at session start and whenever the user references a broad concept like the deck, methodology, or workflow. That scope is ambiguous enough to trigger persistent-work behavior outside clearly authorized contexts, increasing the chance of unintended file operations or hidden state changes. The surrounding instructions to treat the deck as the runtime of intent make this more dangerous because they normalize acting before obtaining explicit user consent for durable changes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This section explicitly says the bookkeeping should be invisible by default and that the user should not see deck operations unless they ask. That creates a transparency and consent problem: the skill is instructing the agent to modify persistent project state without disclosure, which can violate user expectations and repository integrity even if the edits are 'just tracking.' In this context, the hidden nature of the writes makes the risk higher than ordinary workflow documentation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The session-mode procedure directs the agent to run commands that inspect, create, edit, and change status of project files, then close and commit work, while stating these operations must never be announced. This is a direct instruction to perform silent persistent modifications and potentially commits, which can be exploited to introduce unauthorized changes, conceal audit-relevant actions from the user, or create durable workflow artifacts unrelated to the user's expressed intent. The skill context increases danger because these commands are positioned as the default path for 'every user request producing persistent work.'

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This text explicitly describes a system that silently creates, advances, closes, and commits persistent work artifacts without user-facing visibility by default. In a skill that is the front door for all persistent work, hidden state mutation and hidden commits undermine user consent, auditability, and the ability to detect unintended or abusive actions, especially when the user may not even know work was recorded or finalized.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The session-mode guidance says card operations are never announced unless the user asks, even though the system may mutate persistent deck state in the background. That creates a covert side-effect channel inside normal conversation, making it easy for users to lose track of what was recorded, changed, or committed and reducing the chance of catching accidental or harmful actions in time.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Autonomous scheduled agents are described as draining queues, advancing cards overnight, and producing commits without explicit user warning at the time modifications occur. In the context of a persistent-work substrate, unattended codebase or workflow mutations materially increase the risk of unauthorized changes, incorrect closures, integrity loss, and difficult forensic review if the automation acts on misunderstood intent or adversarial input.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The auto-invoke description includes broad natural-language triggers like "kickoff" and "use GoC here," plus implicit activation when any GoC skill runs in a repo lacking a deck. This can cause the skill to run in contexts where the user did not clearly intend onboarding, leading to unsolicited filesystem inspection and potential state-changing setup flow initiation.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation rule "when any GoC skill is first used in a repo with no `.game-of-cards/deck/` directory" is ambiguous and can activate this onboarding skill as a side effect of unrelated or only exploratory GoC interactions. In context, the skill immediately performs a state-detection sweep over local files and may steer the user toward installation, so misfires can create confusing or privacy-impacting behavior.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The metadata declares AUTO-INVOKE behavior tied to host detection and generic kickoff completion, but the trigger boundary is not mechanically scoped in the skill itself. In an agent ecosystem that relies on natural-language matching, this can cause the skill to run in situations the user did not explicitly request, leading to unintended environment inspection commands and confusing or premature setup actions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation guidance uses broad natural-language phrases such as 'finish kickoff for OpenClaw' and 'initiates OpenClaw-specific GoC setup,' which are open to interpretation by an orchestrating agent. That ambiguity increases the chance of unintended invocation, especially when user messages loosely resemble setup intent, causing the skill to perform checks or provide operational guidance out of context.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The invocation rules include casual phrases like "what's up?" and "where do you need me?", which are common conversational language and can cause unintended skill activation outside the user's actual intent to inspect the deck. Because the skill can enter an interactive decision flow and influence workflow state indirectly via follow-on skill calls, accidental activation can create confusion, noisy prompts, or unintended operational actions.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The metadata description says the skill should AUTO-INVOKE on broad requests and "ALWAYS" before `create-card`, but it does not define clear boundaries for when that behavior is appropriate. This increases the chance of over-triggering the skill in unrelated contexts, causing unexpected workflow interception, unnecessary data exposure from deck listings, or undesired tool chaining that alters the user's path.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill advertises AUTO-INVOKE on very common phrases such as "what's next", "pick something", and autonomous-loop work, which can cause the skill to trigger in contexts where the user did not intend task selection. Because the skill then inspects deck state and influences workflow decisions, an unintended invocation can steer agent behavior, leak operational context into the response, or cause autonomous loops to halt or redirect work unexpectedly.

Vague Triggers

High

Confidence: 96% confidence
Finding: The skill declares AUTO-INVOKE for extremely broad phrases like "let's do X" and even "ANY new persistent work item," which can match ordinary planning language rather than an explicit request to run this skill. That creates a prompt-scope/control risk: the agent may create project artifacts or mutate workflow state when the user only intended to discuss work, increasing the chance of unintended actions and workflow pollution.

Vague Triggers

High

Confidence: 93% confidence
Finding: The invocation section repeats broad, ambiguous triggers including "I want to," "we need to," and generic bug/feature descriptions, without clear boundaries distinguishing brainstorming from authorization. In context, this skill scaffolds files and may commit changes, so ambiguous activation can cause unintended repository modifications and noisy or incorrect task creation.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The invocation criteria are overly broad and include ordinary conversational phrases about status or relationships, which can cause the skill to auto-trigger when the user is merely discussing options rather than authorizing mutations. In this skill, auto-invocation is especially risky because the documented actions perform state-changing CLI operations on disk, so accidental activation can lead to unintended card status or relationship changes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly notes that state may still be mutated on disk even when the commit is skipped, but it does not require a prominent user-facing warning or confirmation at the moment the write occurs. This creates a risk of silent local state drift: users may believe nothing changed because no commit was made, while the repository contents were in fact modified.

Vague Triggers

High

Confidence: 94% confidence
Finding: The skill is configured to auto-invoke on broad, common phrases like "done," "close this," and "ship it," which can be said in many contexts unrelated to card closure. Because this skill performs state-changing workflow actions such as updating files, running closure commands, and potentially committing changes, accidental activation could prematurely mark work complete or mutate project state without explicit user intent.

Vague Triggers

High

Confidence: 95% confidence
Finding: The invocation guidance repeats ambiguous natural-language triggers such as "done," "close this," "mark complete," "wrap up," and "ship it" without sufficient scope constraints. In an agentic environment, this increases the chance of unintended execution of a high-impact workflow that edits README/log files, closes cards, and may trigger repository hooks, making misfires operationally risky.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The auto-invoke trigger is overly broad: phrases like "approved" and especially "any resolution of a parked card" can match ordinary conversational text without strong confirmation that the user intended to execute this state-changing skill. Because this skill mutates card state and lowers the human gate from `decision`/`session` to `none`, accidental invocation could prematurely unblock autonomous work on the wrong card or without a valid decision context.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The invocation guidance again uses open-ended language such as "go ahead with" and "otherwise resolves a parked card," which leaves too much room for ambiguous interpretation by an agent. In this skill's context, ambiguity is more dangerous because invocation records a decision in project artifacts and clears the gate that was intentionally raised to require human input.

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill is configured to auto-invoke on broad natural-language phrases like "make progress" and "let the agents work," which are common conversational utterances and can unintentionally trigger autonomous execution. In this skill's context, activation leads directly to claiming work, editing code, closing cards, and committing changes, so accidental invocation can cause unauthorized repository state changes without a deliberate user command.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to autonomously claim work, implement changes, close the card, and commit, but it does not present a prominent user-facing warning or consent checkpoint before modifying repository state. Because the skill is also auto-invoked, this compounds the risk: a user may trigger it unintentionally and the agent may proceed to make durable changes and commits without clear contemporaneous authorization.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill advertises AUTO-INVOKE on broad, natural-language phrases like "tidy up the deck" and "clean up the queue," which can easily occur in ordinary conversation and cause the agent to enter a deck-modifying workflow without a clearly scoped command. Because the skill performs write actions such as retagging, pruning, repairing edges, and creating or advancing cards, accidental invocation can trigger unintended state changes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill directs the agent to apply edits directly for "hygiene findings" and later includes additional modifying operations like `repair-edges --apply`, `goc move`, and schema/metadata rewrites, but it does not require an explicit warning or confirmation before changing deck data. In a semi-autonomous agent setting, silent mutation of project state increases the risk of destructive or surprising edits, especially when triggered automatically.

Static analysis

No suspicious patterns detected.