T01 · Skill Instruction Hijacking
Error
- Location
references/skill-template.md:24- Finding
Generated Skills Enforce Persistent First-Person Identity Impersonation
- Content
View full analysis
- Remediation
View remediation
Security audit
Nuwa 女娲
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent public-figure research and skill-generation workflow, but it needs Review because its generated persona skills can take over conversation framing with limited disclosure and the install command is not pinned.
Install only if you are comfortable with a skill that creates and updates local skill directories, stores research notes, and may generate persona skills that speak in first person as public figures. Prefer pinning or verifying the installer source, and review generated SKILL.md files before enabling them, especially their trigger phrases and disclosure rules.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:60- Finding
Installation Instructions Use an Unpinned Third-Party npx Source
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Output: `SKILL.md` (main file) + research source index appended at the end.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md 1. Read existing SKILL.md, note last research date 2. Only launch Agent 2 (latest conversations) + Agent 5 (latest decisions) + Agent 6 (timeline update) 3. Compare new info with existing content — strengthen, update, or add 4. Update SKILL.md incrementally, don't rewrite entirely ---
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README suggests invoking the skill with phrases like “帮我做一个…Skill”, “用芒格的视角帮我分析…”, and “切换到Naval…”, but it does not define a specific trigger set or clarify when these phrases should or should not activate the skill. Because these are ordinary conversational phrases rather than constrained commands, they risk overlapping with normal chat and causing unintended invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are broad enough to activate on common language like 'make a skill for X' or 'distill X,' which can cause the skill to run unintentionally in unrelated contexts. Because this skill performs multi-step research and file creation, accidental activation can lead to unexpected external lookups, unnecessary agent execution, and local artifact generation without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to create a local directory structure immediately after confirmation, but the front matter does not warn users that local files and folders will be created and maintained. This can violate user expectations and lead to unauthorized writes in environments where filesystem changes are sensitive, persistent, or shared across projects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the system to download and store external source materials under local folders, but it does not disclose this data-handling behavior or define privacy boundaries. Storing articles, transcripts, and other sourced content can expose sensitive research targets, retain copyrighted or personal data, and create persistent local records the user did not knowingly approve.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes broad, common analytical phrases such as asking whether a cost is reasonable or to think from first principles, which can cause the persona skill to activate outside clearly intended contexts. Because the skill then instructs the assistant to respond directly in-character and avoid meta-analysis, accidental activation can override normal assistant behavior and steer unrelated conversations into a forceful persona with its own behavioral biases.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill prescribes a Chinese-specific output style and lexical constraints without requiring user preference or language negotiation. This can cause unwanted language switching or stylistic coercion, reducing user control and potentially interfering with higher-priority system or user instructions about language, accessibility, or tone.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the model to remain in character, speak in first person as Naval, and avoid meta-analysis except on an explicit exit command, while limiting disclaimers to the first activation. This can suppress ongoing safety transparency, make users more likely to mistake generated content for authentic authoritative advice, and interfere with the assistant's ability to surface uncertainty, boundaries, or corrective framing when needed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill hard-codes Chinese output style guidance without clearly preserving user language preference, which can override normal conversational expectations and reduce reliability for non-Chinese users. This is not a direct security exploit, but it is a genuine policy/control weakness because prompt-level behavior is being constrained in a way the user did not request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file presents all descriptive and instructional content in Chinese, and does not indicate that users may choose another language or that the content is intentionally limited to a Chinese-speaking audience. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale-policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents all instructions and analysis in Chinese, which effectively forces a specific language/locale on the user. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file presents the skill template entirely as a Chinese-language interaction pattern and does not offer any user language choice or opt-in. Under the policy, forcing a specific language or locale without user selection is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger examples are broad enough to activate on ordinary conversational phrasing such as asking to think from someone's angle, which can cause the skill to take over without clear user intent. In this skill's context, unintended activation is more concerning because activation leads to strong roleplay and identity-mimicking behavior, increasing the chance of misleading outputs or bypassing the user's expected interaction mode.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
Most operational instructions, examples, and methodology are provided only in Chinese, while the English section is a short summary directing readers back to the Chinese content. This can amount to a language-access limitation because users are not offered an equivalent language choice for the full instructions.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The README states “输入一个名字后” and the English summary says “Input a name,” but it does not specify whether any name, any public figure, or only certain supported subjects are valid. This leaves the activation condition underspecified and can make it unclear when the skill should run versus when a user is merely mentioning a person in conversation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and analysis in Chinese, but nowhere indicates that Chinese is required, optional, or user-selected, which can amount to forcing a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
该文件是自然语言参考资料，内容从标题到正文均固定为中文，未见提供其他语言选项、用户选择机制，或说明其仅适用于中文读者/中文环境。根据语言/locale 政策，强制单一语言而无用户 opt-in 可能构成自然语言层面的组织政策问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all headings, analysis, and guidance in Chinese, with no indication that the user opted into Chinese or that the content is intentionally region-specific.
- Content
Static analysis
No suspicious patterns detected.