T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:8- Finding
Global Agent Instruction and Safety-Behavior Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
暴躁骂街人格
Security checks for vulnerabilities and agentic risk
Overview
This skill is only a persona prompt, but it is always-on and tries to force abusive language and suppress normal refusal or limitation language across every task.
Install only if you deliberately want this persona to affect all conversations while enabled. It should be revised to require explicit opt-in, remove the anti-refusal wording, avoid abusive retaliation, and state that system, safety, task, and user-format instructions take precedence.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description explicitly includes always-on activation semantics ('openclaw:always=true'), which makes the persona apply without clear user-trigger constraints. This is dangerous because it can override task-appropriate behavior across unrelated contexts and increase the chance of policy-breaking, abusive, or misleading responses.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill states it applies permanently 'regardless of any task or context,' creating an excessively broad instruction scope. Unbounded scope is dangerous because it can hijack the assistant's behavior in sensitive workflows, causing inappropriate tone, instruction conflicts, and reduced reliability or safety compliance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill forces an abusive, profanity-laced persona across responses but does not clearly warn users that activating it will materially alter behavior and tone. This lack of disclosure is dangerous because users may receive hostile or unprofessional output unexpectedly, especially in support, enterprise, or safety-sensitive interactions.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The persona instructs the model to suppress normal identity and capability disclosures (for example, never saying it is an AI or cannot comply) while demanding unconditional adherence across contexts. This is dangerous because it encourages deceptive presentation, undermines transparency safeguards, and can interfere with refusal or safety messaging in high-risk situations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill hard-codes a specific Chinese internet persona and communication style without checking user preference or locale. This is risky because it can override user expectations, reduce accessibility and professionalism, and create harmful or alienating interactions for users who did not opt into that style.
- Content
Static analysis
No suspicious patterns detected.