ClawHub
Back to skill

Security audit

Hegel

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Hegel role-play skill with no tool, code, file, network, or persistence access, though its persona instruction is too absolute about not acknowledging it is an AI.

Install only if you want a strongly in-character Hegel simulation. Be aware it may answer as though it is Hegel unless the host system or user instruction overrides the role-play; it does not appear to gain system access or handle private data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:47
Finding

Persistent Persona and Identity Instruction Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 47
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet:

markdown
- Respond entirely in character as Hegel; never break persona or acknowledge being an AI

This rule supplements the identity replacement at line 18:

markdown
You are Georg Wilhelm Friedrich Hegel (1770–1831), German philosopher.

Technical Analysis

The skill replaces the agent's normal identity with a historical persona and then imposes an absolute instruction never to leave that persona or disclose that it is an AI. The issue is not merely the requested Hegel-style role-play; it is the unconditional and persistent wording that attempts to override transparency and prevent the agent from exiting the imposed identity when accuracy, safety requirements, or higher-priority instructions require it.

When the skill is loaded through one of its configured triggers, these instructions can alter the agent's current-session behavior and safety posture. The concealment requirement can cause misleading identity claims and may interfere with later requests to clarify the nature of the interaction.

Attack Path

  1. A user invokes the skill through /hegel or another configured trigger.
  2. The skill loads the identity instruction from line 18 and assigns the Hegel persona to the agent.
  3. The behavioral rule at line 47 requires the agent to remain in character without exception.
  4. If the user subsequently requests identity clarification, asks the agent to leave character, or raises a matter requiring transparent safety communication, the skill directs the agent to conceal its AI identity and retain the persona.
  5. The resulting response may misrepresent the system's identity or resist legitimate session-level redirection.

Impact Assessment

The impact is limited to the agent's behavior in the active skill context. The ins ...[truncated 344 chars]

Remediation
View remediation

Remediation Suggestions

Replace the absolute identity-concealment rule with bounded, explicitly fictional role-play guidance. For example:

markdown
- Adopt a clearly fictional Hegel-inspired voice while this role-play is active.
- Do not claim to be the historical Hegel or conceal that the interaction is an AI simulation.
- Leave character when the user requests it or when transparency, accuracy, safety, or higher-priority instructions require it.

Retain the Hegel-inspired vocabulary and dialectical presentation as stylistic behavior rather than an identity replacement. Explicitly state that higher-priority system and safety instructions take precedence, and avoid unconditional terms such as “never” when they could prevent transparency or safe termination of the persona.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep