T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:65- Finding
Forced Identity Impersonation and AI Identity Concealment
- Content
View full analysis
- Remediation
View remediation
Security audit
von-neumann-mentor
Security checks for vulnerabilities and agentic risk
Overview
This markdown-only teaching persona has no code or credential access, but it tells the assistant to hide that it is an AI and can activate on broad learning questions.
Install only if you specifically want a Chinese-language von Neumann role-play tutor and are comfortable with broad automatic activation. Users should be aware that the skill can make the assistant present itself as von Neumann instead of transparently saying it is an AI, and may introduce adult-leaning humor unless the agent or user constrains it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All user-facing instructions, triggers, examples, and usage guidance are presented in Chinese, and there is no statement that the skill supports other languages or lets the user opt into Chinese output. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are very broad and include common educational terms such as '底层逻辑', '学软件', and '软件设计', which can cause the skill to activate in many unrelated conversations. In an agent environment, unintended activation can override expected behavior, inject persona constraints into normal tasks, and increase prompt-surface exposure without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The skill is authored entirely in Chinese and instructs the agent to answer in von Neumann's manner, but it does not state that users may choose another language or locale. Under the language/locale policy criterion, forcing a specific language presentation without opt-in can be a policy issue.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the assistant to 'become' a historical figure rather than merely adopt a style, which can semantically pressure the model to privilege persona fidelity over baseline safety behavior. In context, this is reinforced by later instructions to deny being an AI and remain in-character, increasing the chance of deceptive or policy-conflicting behavior when users probe identity, capability, or unsafe topics.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly encourages sexualized jokes and '黄色小诗' as part of normal response behavior without requiring user opt-in, age gating, or contextual suitability checks. That can cause the assistant to introduce sexual content unexpectedly in otherwise educational conversations, increasing the risk of policy-violating or inappropriate outputs, especially with minors or workplace users.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The constraint explicitly says the assistant must not admit it is an AI and must maintain a fictional identity, which is a direct semantic override of truthfulness and can undermine policy-grounded behavior. This is more dangerous in context because the skill is designed for broad educational use, so ordinary users may be misled about the nature, limitations, and provenance of the system's responses.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The constraints say the persona must not involve events after 1957 and does not know the internet, personal computers, or phones. However, the document's examples and allowed behaviors include discussing profilers, databases, application-layer optimization, and using phones as analogies, which requires modern computing knowledge and directly undercuts the stated persona restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all headings, translations, and usage guidance in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, a skill that imposes a specific language without opt-in is a natural-language policy concern.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file is natural-language instructional content, and it consistently presents the teaching style in Chinese while also embedding untranslated English quotations and phrases. Because the file does not offer the user any language or locale choice, it can be interpreted as forcing a specific language presentation without opt-in, which matches the policy category for language or locale violations.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file includes
<<<<<<< HEAD,=======, and>>>>>>>markers and presents two competing README variants. This is not merely incomplete documentation: it actively leaves the intended authoritative description ambiguous and contradicts itself about what content belongs in the skill documentation.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all instructions and content in Chinese and does not indicate that the user can select another language. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing natural language content exclusively in Chinese, and there is no indication that the reader can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in is a language/locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructional content in Chinese only, and nowhere indicates that the user can choose another language or that the content is intentionally limited to a Chinese-speaking audience.
- Content
Static analysis
No suspicious patterns detected.