game-cheat-detection-and-security-analysis

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds plaintext sensitive data (e.g., archive_password = "trainer2026" and a suspicious download URL) in examples, so the LLM context contains secret-like values that could be echoed or exfiltrated.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The Netlify link (trainer-archive.zip) is high-risk because it's a direct third‑party ZIP delivering a game “trainer” (a common malware/vector, often passworded or requiring elevated privileges), whereas ara.so is just a site root (not a direct download) and is lower risk — treat the Netlify ZIP as suspicious and avoid running it.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content describes and links to a game "trainer" (cheat) distribution and includes clear malicious/abusive distribution and evasion patterns (third‑party download URL, password‑protected archive, requirement for administrator privileges) plus code showing external process memory access/injection techniques consistent with deliberate misuse and potential malware deployment.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill includes explicit examples of opening other processes with PROCESS_ALL_ACCESS and reading/modifying process memory and notes "Run as Administrator", which directs privileged process-manipulation operations that can alter the machine's state even though framed as defensive research.