Is there anyway to prevent players from being able to query basically any information from a token, or the attributes of the associated NPC? Using the following macro, I'm able from a "players" (not GM) account, get basically anything I want from a token. This is just a subset of the info available. I can query repeating info, any stat, etc.
/w Players &{template:npcaction} {{rname=NPC Stats}} {{name=@{target|character_name}}} {{description=**Bar 1:** @{target|bar1} / @{target|target|bar1|max}
**Bar 2:** @{target|bar2}
**Bar 3:** @{target|bar3}
-----------------------------------------
**NPC Name:** @{target|npc_name}
**CR:** @{target|npc_challenge}
**HP:** @{target|target|hp|max}
**AC:** @{target|npc_ac}
-----------------------------------------
**Senses:** @{target|npc_senses}
**Immunities:** @{target|npc_immunities}
**Resistances:** @{target|npc_resistances}
**Vulnerabilities:** @{target|npc_vulnerabilities}
}}
Here's another example where I can see the actions an NPC has available
/w Players &{template:npcaction} {{rname=@{target|target|repeating_npctrait_$0_name}}} {{name=@{target|character_name}}} {{description=@{target|target|repeating_npctrait_$0_desc}
}}