runtime
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E006: Malicious code pattern detected in skill scripts.
- Malicious code pattern detected (high risk: 1.00). High risk: the Python runtime uses exec on code pulled from adventure data (e.g., exec(buff['effect_py']) and exec(obj['simulate_py'])), which allows arbitrary remote code execution if those strings can be influenced by untrusted input — while no explicit network exfiltration or obfuscated payloads are present, RCE could easily be used to exfiltrate data or install backdoors.
Audit Metadata