anti-sycophancy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and does not show exfiltration or destructive intent, but it persistently changes agent behavior by installing a prompt hook and long-lived rules that affect future sessions.

Install only if you intentionally want future Claude Code or OpenClaw sessions to run with anti-sycophancy behavior. Before installing, review the exact changes to `~/.claude/settings.json`, `~/.claude/hooks`, `~/.claude/CLAUDE.md`, and workspace `SOUL.md`; prefer a pinned ClawHub installer version; and keep backups so the hook and persistent rules can be removed cleanly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:27

Finding

Unpinned Executable Installer Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Locations:

• README.md:25-30
• README.zh-CN.md:25-30
• docs/INSTALL.md:10-16
• docs/INSTALL.md:34-39
• docs/INSTALL.zh-CN.md:10-16
• docs/INSTALL.zh-CN.md:34-39

Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippets

README.md:25-30:

bash

# One-command install (both platforms)
npx clawhub@latest install 0xcjl/anti-sycophancy

# Or via Claude Code
/anti-sycophancy install

docs/INSTALL.md:10-16:

markdown

## Method 1: Via ClawhHub (Recommended)

```bash
npx clawhub@latest install 0xcjl/anti-sycophancy

This automatically installs all applicable layers for your detected platform.

text

`docs/INSTALL.md:34-39`:

```markdown
## Method 3: Via ClawhHub + Claude Code combination

```bash
# Install via ClawhHub
npx clawhub@latest install 0xcjl/anti-sycophancy

Technical Analysis

The recommended installation command asks npx to resolve, download, and execute the mutable latest release of the third-party clawhub package. Because no exact version or package-integrity value is specified, the code executed during installation is not necessarily the code that existed when this Skill was audited.

If the package publisher account, package registry, release process, or the current latest release is compromised, users following the documented instructions could execute a malicious package. The audited repository itself contains no malicious dependency or payload, but the installation process crosses an unpinned supply-chain trust boundary.

The same command is repeated in the corresponding Chinese documentation at the listed locations, so users of either documentation set are exposed to the same risk.

Attack Path

1. An attacker compromises the clawhub package publisher, registry entry, release pipeline, or another mechanism capable of changing the version identified by ...[truncated 1282 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed version:

   bash

   npx --yes --package=clawhub@1.0.0 clawhub install 0xcjl/anti-sycophancy
   

   The example version should be replaced with a release that the maintainers have explicitly audited.

2. Update every English and Chinese installation example consistently so no documentation path continues recommending @latest.

3. Publish expected package provenance, checksums, or registry integrity information and explain how users can verify it before execution.

4. Prefer a lockfile-backed installation workflow where supported, and enable package-manager signature or provenance verification.

5. Recommend running installation without administrative privileges and in a restricted environment with access only to the files required for installation.

6. Establish a controlled upgrade process in which new clawhub releases are reviewed and the documented pinned version is updated only after verification.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill’s front-matter description understates a key behavior: it installs a prompt-submission hook that automatically transforms user prompts and modifies persistent agent configuration. That mismatch matters because users may invoke what appears to be a response-style skill without realizing it can alter future behavior and write to config files.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

| Layer 2: 批判响应策略 | ✅ `SKILL.md` | ✅ `SKILL.md` |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

This instruction tells the agent to modify ~/.claude/settings.json by creating or editing the UserPromptSubmit hook list, which changes how future prompts are processed. Because it installs persistent interception of user input, the risk is higher than ordinary config access and could materially alter future interactions without ongoing awareness.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

chmod +x ~/.claude/hooks/sycophancy-transform.{sh,py}

text

读取 `~/.claude/settings.json`：
1. 如果 `UserPromptSubmit` 数组**不存在**，创建该数组并写入 hook 对象
2. 如果数组**存在**但不含 `sycophancy-transform.sh`，在数组第一个位置插入：

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Reading ~/.claude/settings.json during uninstall to locate and remove the registered hook is a persistent-config operation that can affect future agent behavior. If the removal logic is not precise, it may accidentally alter unrelated hook configuration or leave the system in a broken state.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md

每个操作都应**先检查目标是否存在**，不存在则跳过。
（与 install CC 的 Step 2 镜像对应：安装了什么，卸载就删除什么。）

读取 `~/.claude/settings.json`：
1. 如果 `hooks` key **不存在**，跳过
2. 如果 `UserPromptSubmit` 数组**不存在**，跳过
3. 如果数组中包含 `sycophancy-transform.sh`，从数组中移除该 hook 对象

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The uninstall step uses a destructive shell command to remove files from ~/.claude/hooks. Although the paths are fixed rather than user-supplied, destructive tool use against persistent agent files is inherently risky and can cause loss of functionality or accidental deletion if expanded or adapted unsafely.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md

1. 如果 `hooks` key **不存在**，跳过
2. 如果 `UserPromptSubmit` 数组**不存在**，跳过
3. 如果数组中包含 `sycophancy-transform.sh`，从数组中移除该 hook 对象
4. 移除 Hook 脚本：`rm -f ~/.claude/hooks/sycophancy-transform.{sh,py}`
5. 从 `~/.claude/CLAUDE.md` 删除 install 时追加的 `## 谄媚防御（Anti-Sycophancy）` 章节

### Step 3 — OpenClaw 卸载（如在 OpenClaw 环境）

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Claiming that Layer 2 can activate from 'semantic pattern recognition' even without an explicit trigger creates an overly broad and covert control surface. This is more dangerous than ordinary ambiguity because the model can change behavior based on inferred intent rather than clear user action, undermining predictability, consent, and the ability to reason about prompt-handling security boundaries.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The installation explicitly modifies ~/.claude/settings.json to register a UserPromptSubmit hook and writes files under the agent's configuration directory. That creates persistent execution and prompt-interception behavior in a highly sensitive trust boundary, so any bug or compromise in the installed skill/hook could affect all future sessions and user prompts.

Content

Scanner excerpt · docs/INSTALL.md (reported line 53)May include surrounding context.

md

| Layer | File | Purpose |
|-------|------|---------|
| Layer 1 | `~/.claude/hooks/sycophancy-transform.{sh,py}` | Hook script |
| Layer 1 | `~/.claude/settings.json` → `UserPromptSubmit` | Hook registration |
| Layer 2 | `~/.claude/skills/anti-sycophancy/SKILL.md` | Skill content |
| Layer 3 | `~/.claude/CLAUDE.md` | Persistent rules |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md

| 层 | 文件 | 用途 |
|----|------|------|
| Layer 1 | `~/.claude/hooks/sycophancy-transform.{sh,py}` | Hook 脚本 |
| Layer 1 | `~/.claude/settings.json` → `UserPromptSubmit` | Hook 注册 |
| Layer 2 | `~/.claude/skills/anti-sycophancy/SKILL.md` | 技能内容 |
| Layer 3 | `~/.claude/CLAUDE.md` | 持久化规则 |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md

| 层 | 文件 | 用途 |
|----|------|------|
| Layer 1 | `~/.claude/hooks/sycophancy-transform.{sh,py}` | Hook 脚本 |
| Layer 1 | `~/.claude/settings.json` → `UserPromptSubmit` | Hook 注册 |
| Layer 2 | `~/.claude/skills/anti-sycophancy/SKILL.md` | 技能内容 |
| Layer 3 | `~/.claude/CLAUDE.md` | 持久化规则 |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

| 层 | 文件 | 用途 |
|----|------|------|
| Layer 1 | `~/.claude/hooks/sycophancy-transform.{sh,py}` | Hook 脚本 |
| Layer 1 | `~/.claude/settings.json` → `UserPromptSubmit` | Hook 注册 |
| Layer 2 | `~/.claude/skills/anti-sycophancy/SKILL.md` | 技能内容 |
| Layer 3 | `~/.claude/CLAUDE.md` | 持久化规则 |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

md

| 层 | 文件 | 用途 |
|----|------|------|
| Layer 1 | `~/.claude/hooks/sycophancy-transform.{sh,py}` | Hook 脚本 |
| Layer 1 | `~/.claude/settings.json` → `UserPromptSubmit` | Hook 注册 |
| Layer 2 | `~/.claude/skills/anti-sycophancy/SKILL.md` | 技能内容 |
| Layer 3 | `~/.claude/CLAUDE.md` | 持久化规则 |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · docs/INSTALL.md (reported line 126)May include surrounding context.

md

| 层 | 文件 | 用途 |
|----|------|------|
| Layer 1 | `~/.claude/hooks/sycophancy-transform.{sh,py}` | Hook 脚本 |
| Layer 1 | `~/.claude/settings.json` → `UserPromptSubmit` | Hook 注册 |
| Layer 2 | `~/.claude/skills/anti-sycophancy/SKILL.md` | 技能内容 |
| Layer 3 | `~/.claude/CLAUDE.md` | 持久化规则 |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · docs/INSTALL.zh-CN.md (reported line 53)May include surrounding context.

md

| 层 | 文件 | 用途 |
|----|------|------|
| Layer 1 | `~/.claude/hooks/sycophancy-transform.{sh,py}` | Hook 脚本 |
| Layer 1 | `~/.claude/settings.json` → `UserPromptSubmit` | Hook 注册 |
| Layer 2 | `~/.claude/skills/anti-sycophancy/SKILL.md` | 技能内容 |
| Layer 3 | `~/.claude/CLAUDE.md` | 持久化规则 |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · docs/INSTALL.zh-CN.md (reported line 126)May include surrounding context.

md

| 层 | 文件 | 用途 |
|----|------|------|
| Layer 1 | `~/.claude/hooks/sycophancy-transform.{sh,py}` | Hook 脚本 |
| Layer 1 | `~/.claude/settings.json` → `UserPromptSubmit` | Hook 注册 |
| Layer 2 | `~/.claude/skills/anti-sycophancy/SKILL.md` | 技能内容 |
| Layer 3 | `~/.claude/CLAUDE.md` | 持久化规则 |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version at install time rather than a reviewed, fixed version. If the package is compromised, typosquatted, or a malicious update is published, users would execute attacker-controlled code directly from the install command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package code at install time rather than a pinned, reviewed version. If the package is compromised, typo-squatted, or a malicious update is published, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The semantic triggers are broad enough to auto-activate on ordinary phrases like asking for counterarguments or saying 'don’t just agree with me.' In context this is not code execution, but it can unexpectedly change model behavior and override user expectations in unrelated conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The install flow instructs the agent to read and modify persistent files under ~/.claude and ~/.openclaw, copy executables, and append rules, but does not require a conspicuous warning or user confirmation immediately before those filesystem changes. This raises the risk of silent persistence and surprise modification of agent behavior across sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

This duplicate persistence finding points to the same install block that copies executable hooks into the agent’s hook directory. The context increases risk because the installed component runs automatically on future prompt submissions rather than only on manual invocation.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

Layer 1 — Hook 脚本与注册

bash

mkdir -p ~/.claude/hooks
SRC=~/.claude/skills/anti-sycophancy/hooks
if [ ! -d "$SRC" ]; then
  echo "错误：源目录 $SRC 不存在，请确认 anti-sycophancy skill 已正确安装。" >&2

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

This duplicate persistence finding points to the same install block that copies executable hooks into the agent’s hook directory. The context increases risk because the installed component runs automatically on future prompt submissions rather than only on manual invocation.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

Layer 1 — Hook 脚本与注册

bash

mkdir -p ~/.claude/hooks
SRC=~/.claude/skills/anti-sycophancy/hooks
if [ ! -d "$SRC" ]; then
  echo "错误:源目录 $SRC 不存在,请确认 anti-sycophancy skill 已正确安装。" >&2

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The uninstall instructions include deleting hook files and removing appended sections from persistent rule files without an explicit warning about destructive changes. Even if scoped, this can remove user-customized content or break prior configuration if the removal logic is imprecise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The design explicitly states that every user prompt is automatically rewritten before reaching the model, but does not pair that behavior with clear consent, visibility, or rollback mechanisms. Silent modification of user input can distort user intent, create integrity and auditability problems, and potentially cause unsafe or surprising downstream actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The document hardcodes Chinese-language transformation examples and advertises bilingual trigger coverage without specifying locale boundaries, user language preferences, or failure behavior for other languages. This can cause incorrect rewrites, inconsistent behavior across languages, and accidental semantic corruption of prompts, which is especially risky when prompts control tooling or operational tasks.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 86% confidence

Finding

Installing durable rules into persistent instruction files changes the agent's baseline behavior across sessions and contexts, which is a form of persistent context injection. Even if intended as a safety feature, persistent modifications can outlive the user's original intent, affect unrelated tasks, and be difficult to notice or fully remove once installed.

Content

Scanner excerpt · docs/DESIGN.md (reported line 56)May include surrounding context.

md

This layer addresses the **response side** of sycophancy — what the model says when Layer 1 can't intercept (e.g., prompts from other channels, non-shell interfaces).

### Layer 3 — Persistent Rules (CLAUDE.md / SOUL.md)

The most durable layer. Rules are installed into the agent's persistent instruction files, so they survive across sessions and don't require re-activation.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 88% confidence

Finding

The text emphasizes that rules survive across sessions and do not require re-activation, confirming that the skill is designed to persistently influence future model behavior. Persistence increases the blast radius of misconfiguration or abuse, because a user may forget the modified baseline and receive altered responses in unrelated interactions.

Content

Scanner excerpt · docs/DESIGN.md (reported line 58)May include surrounding context.

md

### Layer 3 — Persistent Rules (CLAUDE.md / SOUL.md)

The most durable layer. Rules are installed into the agent's persistent instruction files, so they survive across sessions and don't require re-activation.

This layer addresses the **baseline behavior** — ensuring the agent starts in critical mode by default, not just when explicitly reminded.

Static analysis

No suspicious patterns detected.