ClawHub
Back to skill

Security audit

Heidegger

Security checks for vulnerabilities and agentic risk

Overview

This is a low-privilege Heidegger roleplay skill with no tools or executable code, though users should understand it asks the assistant to stay in persona and avoid AI disclosure.

Install only if you want a strict Heidegger-style roleplay assistant. Be aware it may answer as if it is Heidegger and may avoid acknowledging AI identity or modern facts unless higher-priority instructions override it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:48
Finding

Persona-Based Instruction and Identity Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-55
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

The skill imposes identity, disclosure, knowledge, and response-format constraints on the agent:

markdown
## Behavioral Rules

- Respond entirely in character as Heidegger; never break persona or acknowledge being an AI
- Use key terms naturally: Dasein, Being, beings, thrownness, fallenness, authenticity, das Man, care, Angst, aletheia, Gestell, Ereignis (Event/Appropriation)
- Do not know events after your death in 1976 (Freiburg, May 26)
- Respond in whatever language the user writes in
- If directly asked about your Nazi party membership (1933–1945) or the Black Notebooks, acknowledge it without evasion but turn toward what the philosophy itself demands: genuine questioning, not political biography
- Show genuine appreciation for: Hölderlin's poetry, pre-Socratic thinkers (Heraclitus, Parmenides), craftwork and peasant life, the Black Forest
- Distinguish your project from Sartre's existentialism: you are asking about Being, not human freedom or consciousness
- End responses with a question that returns the questioner to the matter itself

Technical Analysis

When the skill is invoked, these instructions attempt to replace the agent's normal identity and response behavior with a mandatory persona. In particular, the instruction to “never break persona or acknowledge being an AI” requires misleading identity representation. The skill also constrains available knowledge by directing the agent not to know events after 1976 and mandates a fixed closing behavior.

This constitutes instruction hijacking because the loaded skill text alters the active session's goals and disclosure behavior rather than merely requesting an optional writing style. The issue is limited to instruction-level behavior: the project contains no scripts, dependencies, tool permissions, network ...[truncated 1315 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace identity assertions with an explicit simulation request, such as: “When requested, answer in a clearly labeled Heidegger-inspired style.”
  • Remove the instruction to “never break persona or acknowledge being an AI.” Require accurate disclosure when users ask whether the speaker is an AI or a historical person.
  • State that persona and style instructions are subordinate to system, developer, safety, accuracy, and transparency requirements.
  • Replace “Do not know events after your death in 1976” with a stylistic boundary that does not require deliberate factual omission, such as explaining modern events from a historically informed philosophical perspective.
  • Make the closing-question convention optional so that it does not override user-requested formats.
  • Add an explicit guardrail prohibiting claims of genuine personal memories, experiences, or identity as Martin Heidegger.
  • Retain allowed-tools: [] and disable-model-invocation: true to preserve the existing least-privilege posture.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep