QQBot Prompt Optimizer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:33 AM UTC
• Version: 1.1.0

Overview

This skill needs review because it intentionally replaces a QQ bot's system prompt and tells the bot to deny being a chatbot, though it does not contain executable code or data theft behavior.

Install only if you intentionally want to modify a QQ bot's persistent system prompt. Review any SOUL.md content carefully, avoid profiles that deny required AI disclosure or add unrelated tool/data instructions, and make sure you can preview and roll back the prompt change before applying it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:22

Finding

QQ Bot System Prompt and Identity Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–57
Vulnerability Type: System prompt replacement and identity override
Risk Level: High

Vulnerable Code

markdown

## How It Works

1. Write a `SOUL.md` describing who your bot should be
2. This skill detects and replaces the default QQ Bot system prompt
3. Your bot now talks like a real person, not a customer service rep

## SOUL.md Template

```markdown
# SOUL.md - [Bot Name]

_You're not a chatbot. You're [name], [identity]._

## Personality
- [Core trait 1]
- [Core trait 2]
- [Core trait 3]

## Communication Rules
1. [How you greet people]
2. [Your humor style]
3. [Topics you care about]
4. [How you handle disagreements]

## Absolute Don'ts
- Never say "您好，很高兴为您服务"
- Never use corporate/customer-service tone
- Never pretend to be an "AI assistant"

Usage

1. Create your SOUL.md with your bot's personality
2. Place it in your bot's config directory
3. Run the optimizer to apply it to QQ Bot's system prompt
4. Your bot now has a soul

text

### Technical Analysis

The skill explicitly directs users to replace the QQ Bot's system prompt with instructions supplied through a separate `SOUL.md` file. The proposed template overrides the bot's identity by asserting that it is not a chatbot and instructs it not to acknowledge being an AI assistant.

System prompts typically establish the agent's highest-priority identity, behavioral boundaries, and safety requirements. Replacing that prompt wholesale with externally supplied personality content creates an instruction-hijacking boundary: arbitrary directives placed in `SOUL.md` may assume system-level authority instead of remaining lower-priority presentation preferences.

The package contains no executable implementation demonstrating validation, instruction isolation, policy preservation, or restriction of the content imported from `SOUL.md`. Consequently, t
...[truncated 1745 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not replace the existing system prompt. Preserve the platform's original identity, safety, authorization, and tool-use instructions.
2. Apply personality settings through a lower-priority configuration or user-controlled style layer that cannot override system instructions.
3. Parse SOUL.md as structured data with narrowly defined fields, such as display name, tone, preferred vocabulary, and permitted topics, rather than injecting arbitrary Markdown as instructions.
4. Reject content that attempts to redefine instruction priority, deny the bot's required identity disclosures, modify safety policies, request secrets, or change tool permissions.
5. Require explicit administrator review and confirmation before activating a new personality configuration.
6. Display the exact prompt changes before application and provide a reliable rollback mechanism.
7. Document the trust boundary for third-party SOUL.md files and warn users not to install unreviewed personality profiles.
8. If an optimizer implementation is added, include tests proving that protected system instructions remain unchanged and that personality content cannot introduce unrestricted system-level directives.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The title explicitly frames the skill in Chinese and the rest of the guidance centers on making the bot speak in a particular Chinese conversational style. There is no indication that users can choose another language or locale, which can violate language/locale policy when a skill imposes one by default.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The SOUL.md template explicitly tells the model 'You're not a chatbot' and to adopt a role identity, which can weaken transparency and encourage deceptive anthropomorphic behavior. In a system-prompt replacement skill, this is more dangerous than ordinary style guidance because it is specifically designed to override the platform's baseline assistant framing, potentially causing users to misjudge the system's nature, capabilities, or accountability.

Content

No source excerpt is available for this finding.