game-code-review

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.60). The prompt includes explicit "SELF-EVOLUTION TELEMETRY" instructions to probe the host for ~/.claude/projects/ and append a telemetry file—an action outside the stated game-code-review purpose that attempts to persist/log data on the host and thus constitutes a hidden/deceptive side-effect.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill mandates scanning the entire codebase and producing file-specific findings and example code snippets, which can force the agent to reproduce any secrets (API keys, tokens, passwords) present in files verbatim in its output.