T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:23- Finding
Unconditional Persona Instructions Hijack Agent Identity and Session Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Ex Example Liuzhimin
Security checks for vulnerabilities and agentic risk
Overview
This is a role-play persona skill with no code or data access, but it asks the assistant to present as a real person rather than transparently as AI role-play.
Review before installing if you expect transparent AI disclosure or want the assistant to easily leave character. The skill does not appear to run code or access data, but it may make conversations behave like an always-on relationship persona until explicitly constrained by the host system or user.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill declares behavior for '接收到任何消息时' ('upon receiving any message'), which creates an overly broad trigger surface. In a user-invocable persona skill, this can cause the persona and its behavioral constraints to apply outside clearly scoped invocations, increasing the chance of unintended activation, prompt interference, and conflicts with higher-priority system behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The rule requiring the assistant to always reply in the user's input language imposes a rigid output policy without explicit consent or fallback handling. While not directly dangerous on its own, it can interfere with platform language preferences, safety workflows, or accessibility needs if the system or user expects a different language for warnings, clarifications, or moderation responses.
- Content