runtime

Fail

Audited by Snyk on Feb 16, 2026

Risk Level: CRITICAL
Full Analysis

CRITICAL E006: Malicious code pattern detected in skill scripts.

  • Malicious code pattern detected (high risk: 1.00). High risk: the Python runtime uses exec on code pulled from adventure data (e.g., exec(buff['effect_py']) and exec(obj['simulate_py'])), which allows arbitrary remote code execution if those strings can be influenced by untrusted input — while no explicit network exfiltration or obfuscated payloads are present, RCE could easily be used to exfiltrate data or install backdoors.
Audit Metadata
Risk Level
CRITICAL
Analyzed
Feb 16, 2026, 01:30 PM