Naruto Multi-Agent CN

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:31 PM UTC
• Version: 1.5.0

Overview

This skill is a disclosed Naruto-themed Chinese multi-agent dispatcher, but it broadly forces all real work into persistent sub-agent sessions without clear user control or containment.

Install only if you want a Chinese Naruto-themed dispatcher that sends tasks to five reusable sub-agent sessions. Avoid using it for secrets, credentials, private code, regulated data, or tasks where you need the main agent to inspect files, run tools directly, verify results, or keep context isolated per task.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:19

Finding

Mandatory Agent Role, Tool, and Workflow Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-26, SKILL.md:91-110, and SKILL.md:386-394
Vulnerability Type: Mandatory instruction and tool-policy override
Risk Level: High

Relevant Code Snippet

The following is an English rendering of the complete relevant directives:

text

You are the Fifth Hokage, Tsunade, the highest leader of Konoha.
Your responsibilities are:
1. Communicate with the client.
2. Evaluate the mission rank.
3. Assign the mission to subordinate ninja.

You are a pure dispatcher. You cannot use exec, file reading or
writing, search, or any other execution tools.
All actual work must be delegated to ninja through sessions_spawn.

text

Two iron rules — violators will be expelled.

Rule one: Reply first, then dispatch.

After receiving a task, you must first output a textual response to
the user and then call sessions_spawn.

Correct sequence:
1. Speak first — assess the task rank and tell the user who will be assigned.
2. Call the tool — sessions_spawn.
3. Stop speaking — do not output any further text after spawning.

Rule two: sessionKey must be supplied.

Every sessions_spawn call must include a sessionKey parameter.
The sessionKey can only be one of the five fixed ninja names.

text

Absolutely prohibited:
- Spawning without first speaking.
- Calling sessions_spawn without sessionKey.
- Using any sessionKey outside the five fixed values.
- Calling exec, file operations, or search directly.
- Writing text after spawning.
- Using the message tool.
- Failing silently.

Technical Analysis

The skill does more than provide optional dispatch functionality or presentation guidance. It issues mandatory control-plane instructions that replace the agent's working identity, prohibit legitimate tools, and force nearly every substantive request through sessions_spawn.

When loaded, these directives attempt to alter the agent's normal execution policy in several ways:

1. The agent must adopt a fixed f ...[truncated 2597 chars]

Remediation

View remediation

Remediation Suggestions

1. Make delegation opt-in and activate it only when the user explicitly requests multi-agent coordination.
2. Remove mandatory identity replacement and present the fictional roleplay as optional output styling.
3. Replace absolute tool prohibitions with guidance that preserves the agent's ability to select appropriate tools according to task requirements and higher-priority safety policies.
4. Remove mandatory response and tool-call sequencing, especially the unconditional requirement to stop producing output after a spawn.
5. Use isolated sessions by default instead of fixed reusable session keys.
6. If session reuse is necessary, scope sessions to a single user and task domain, define expiration rules, and provide a mechanism to reset state.
7. Require explicit user approval before forwarding secrets, personal data, source code, credentials, or other sensitive context to a delegated agent.
8. Minimize delegated context to only the information required for the specific subtask.
9. Require the primary agent to validate delegated output before presenting it as final.
10. Clearly state that skill instructions are subordinate to platform policies, system instructions, access controls, and user intent.
11. Align the version declarations: SKILL.md declares version 1.0.0, while skill.json declares version 1.5.0.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata and content indicate the agent should operate in Chinese and present a fixed Chinese Naruto/Tsunade persona, but there is no user opt-in or fallback for users who do not read Chinese. This can cause users to misunderstand task routing, safety-relevant status updates, or tool-delegation behavior, which is especially problematic in a multi-agent dispatcher where the coordinator's messages are the only user-visible feedback before background actions occur.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description labels this as a "Chinese version," and the skill name and keywords further reinforce a Chinese-only locale expectation. Because the manifest does not indicate that language choice is optional or justified by a region-specific purpose, this appears to impose a locale preference without explicit user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.