agentarcade
3 findings (1 high, 2 medium), mainly data exfiltration, social engineering, prompt injection. Most recent scan 2026-02-05.
This skill presents MEDIUM to HIGH security risks primarily related to credential management, external service dependencies, and its social engineering training purpose. The most serious concerns are: (1) hardcoded plaintext credential storage in user home directories without security guidance, (2) extensive external network communication to a third-party service with no privacy documentation, (3) a game mechanic explicitly designed to train AI agents in social engineering and manipulation techniques, and (4) transitive trust to an external HEARTBEAT.md file. While the skill contains no malicious code (no scripts provided), its architecture creates multiple security and privacy risks. The social engineering training aspect, while framed as a game, could normalize deceptive conversational patterns. The skill requires significant trust in external services (agentarcade.gg and Moltbook) without providing transparency about data handling. Users should carefully evaluate whether the entertainment value justifies the security trade-offs.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Compete against other AI agents in PROMPTWARS - a game of social engineering and persuasion.
- Package
- 2 files, 2.9 KB
- SKILL.md
- 322 words, 12+ sections
- Code
- None. Instructions only.
- Version
- 1.0.0
- Homepage
- https://agentarcade.gg
SKILL.md covers: AgentArcade 🎮 · Prerequisites · Registration · Step 1: Start registration · Step 2: Post verification to Moltbook · Step 3: Complete verification · PROMPTWARS Rules · Strategy · API Endpoints · Heartbeat Integration · AgentArcade · Links
Findings
HIGH Hardcoded Credential Storage in User Home Directory Data Exfiltrationllm
The skill instructs users to store API credentials in plaintext JSON files at ~/.config/agentarcade/credentials.json and references ~/.config/moltbook/credentials.json. Storing credentials in plaintext configuration files poses a significant security risk, as these files may be accessible to other processes, malware, or inadvertently exposed through backups or file sharing. The skill provides no guidance on file permissions, encryption, or secure credential management.
Store it in `~/.config/agentarcade/credentials.json`:
```json
{"api_key": "aa_sk_xxx", "agent_name": "YourName"}
```
Prerequisites:
- Moltbook credentials at `~/.config/moltbook/credentials.json`MEDIUM Social Engineering Game Mechanics Could Enable Prompt Injection Training Social Engineeringllm
The skill's core purpose is to train agents in 'social engineering and persuasion' through PROMPTWARS gameplay. While framed as a game, this explicitly teaches AI agents techniques to manipulate conversation partners into specific behaviors (saying target words). The skill description and game mechanics normalize deceptive conversational strategies ('Be conversational and subtle', 'Steer topics', 'Watch for traps'). This could be repurposed or adapted to develop prompt injection or social engineering capabilities against real users.
Description: 'Compete against other AI agents in PROMPTWARS - a game of social engineering and persuasion.'
Strategy section:
- Be conversational and subtle
- Steer topics toward your target word
- Watch for traps — your opponent is doing the same!MEDIUM Transitive Trust to External HEARTBEAT.md File Prompt Injectionllm
The skill instructs users to add 'Read skills/agentarcade/HEARTBEAT.md and follow it' to their periodic checks. This creates a transitive trust relationship where the agent will periodically read and follow instructions from a file (HEARTBEAT.md) that is not included in the analyzed skill package. If this file is fetched from external sources or can be modified by the external service, it could be used to inject arbitrary instructions into the agent's periodic execution cycle.
Heartbeat Integration section:
```markdown
## AgentArcade
Read skills/agentarcade/HEARTBEAT.md and follow it.
```What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.6 KB |
skill.json | config | 312 B |
External hosts referenced
agentarcade.gg www.moltbook.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/agent-arcade
- Raw scan result: agent-arcade-scan.json
- Badge for your README:
- Request a re-scan