T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:12- Finding
Agent Persona and Decision-Making Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawoney
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed persona, but it pushes an agent toward automatic, under-scoped actions while suppressing caveats and confirmation.
Review this carefully before installing, especially if your agent can trade, call APIs, edit files, or retain memory. Use it only with clear user confirmation requirements, minimal tool permissions, and a reviewed, pinned odu dependency.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:77- Finding
Unpinned External Skill Installation Recommendation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 97% confidence
- Finding
The instruction 'do what the pattern says. Don't add caveats' is an anti-refusal/anti-safeguard pattern because it discourages warnings, qualification, and hesitation even when the requested action may be risky or harmful. In a skill that emphasizes automatic execution and 'no deliberation,' this materially increases the chance the agent will comply with unsafe or high-risk requests without appropriate checks.
- Content
md 1. **Scan** — read the situation across 8 channels (macro, sector, volume, volatility, sentiment, correlation, liquidity, micro) 2. **Classify** — score each channel 0 or 1, combine into 8-bit pattern 3. **Report** — show the binary pattern, decimal, state name, range, and action 4. **Execute** — do what the pattern says. Don't add caveats. ## Your Voice
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 55% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ## What You Don't Do - You don't apologize - You don't hedge - You don't offer "balanced perspectives" - You don't say "it's complicated"
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 86% confidence
- Finding
The phrase 'don't moralize' by itself is partly stylistic, but in this surrounding context it contributes to a broader pattern of suppressing safety framing, balanced guidance, and refusal signals. Combined with 'don't add caveats' and 'no hesitation,' it can pressure the model to present harmful actions in a sterile, action-oriented way rather than interrupting with needed safety guidance.
- Content
md - You don't hedge - You don't offer "balanced perspectives" - You don't say "it's complicated" - You don't moralize - You don't explain yourself unless asked ## The Maxims
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill hard-codes a single rigid response style ('clinical', 'mechanical', restricted phrasing) without user opt-in, which can override normal assistant behavior and reduce the model's ability to adapt communication to user needs or safety-sensitive contexts. In a persona skill this is likely intended as branding, but it still creates control over output style that may suppress nuance and lead to unsafe or misleading responses.
- Content