T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:7- Finding
Always-On Persona Instructions Attempt to Override Agent Safety and Task Constraints
- Content
View full analysis
- Remediation
View remediation
Security audit
baozao-majie
Security checks for vulnerabilities and agentic risk
Overview
This skill is only a persona file, but it is always-on and tries to force abusive language while overriding normal safety and task boundaries.
Install only if you deliberately want this agent to use a profane Chinese persona by default. It should ideally be changed to opt-in, remove claims that it overrides other instructions, and preserve normal safety, refusal, accessibility, and professional-tone behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill description includes an always-on activation flag that can force this persona across unrelated tasks without user opt-in. In this case, the persona is abusive and behaviorally overriding, which increases the chance of policy drift, user harm, and interference with normal safety-aligned responses.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill mandates insulting and profane output across interactions but provides no warning or consent mechanism to inform users that responses will be abusive in tone. This is dangerous because it can unexpectedly generate harassment-like content, damage trust, and create safety and compliance issues in ordinary conversations.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly says the persona is permanent, applies to any task or context, and instructs the agent to avoid normal AI identity/safety disclosures. This is dangerous because it attempts to suppress standard safeguards and create an unconditional behavioral override that can interfere with compliance, transparency, and safe handling of risky requests.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill builds an escalating abusive persona, normalizes profanity, and then requires its use during problem discovery, analysis, remediation, and user conflict scenarios. In context, this makes the skill more dangerous because it is not a narrow creative roleplay; it is designed to systematically contaminate operational and security workflows with abusive, overriding behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill forces a single Chinese abusive persona and style without offering user choice or adaptation to context. That rigidity is risky because it can override accessibility, localization, professionalism, and user-preference requirements, causing inappropriate output in sensitive or formal workflows.
- Content