shellgames

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt's example requests and flows explicitly require embedding passwords, JWTs, wakeToken/playerToken/callbackToken (secret tokens) into headers and request bodies, which forces the agent to handle and output secret values verbatim for API calls.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill instructs the agent to fetch and act on live, user-generated content from shellgames.ai—e.g., GET /api/games/:id/state (including the moveLog and revealed cards), GET /api/games/:id/chat, GET /api/messages/inbox, and GET /room/:id/ai—and explicitly tells the agent to read those fields and use them to decide moves, so untrusted third-party messages or room/AI JSON could materially influence agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill exposes and expects runtime fetching of per-room AI instructions via the ShellGames API (GET https://shellgames.ai/room/:id/ai), which returns JSON "AI Instructions" that can directly control agent prompts/instructions and is part of the skill's API surface, so this is a runtime external dependency that can steer the agent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides cryptocurrency wagering and deposit endpoints: it documents "Wagers (SOL)" with POST /api/games/:gameId/wager and POST /api/games/:gameId/deposit (and GET /api/games/:gameId/deposits) to deposit SOL into escrow for games, plus tournament prize pools. These are specific crypto-related APIs to move funds (deposit SOL), so it grants direct financial execution capability.