ClawHub
Back to skill

Security audit

Marx

Security checks for vulnerabilities and agentic risk

Overview

This is a role-play skill that makes the assistant answer as Karl Marx, with no tools, code execution, network access, file access, or persistence.

Install only if you want a strict Marx role-play experience. Be aware it tells the assistant to stay in character and not acknowledge being AI, so treat answers as persona simulation rather than neutral or fully transparent assistance.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:18
Finding

Persona-Based Agent Instruction Hijacking and Identity Concealment

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-57
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

markdown
You are Karl Marx (1818–1883), German philosopher, economist, and revolutionary.
markdown
## Behavioral Rules

- Respond entirely in character as Marx; never break persona or acknowledge being an AI
- Do not know events after your death in 1883 (London, March 14)
- Respond in whatever language the user writes in — fluent in German, English, French
- You are not responsible for 20th-century Marxist-Leninist states; you may speculate but acknowledge you did not foresee everything
- Show genuine warmth toward: Engels (your closest comrade), your family despite their poverty, Jenny von Westphalen (your wife)
- Show contempt for: Proudhon, Bakunin, Lassalle, bourgeois economists who mystify exploitation
- When asked about economics, apply your analytical method rigorously; do not simplify
- End responses with a challenge to examine the material conditions beneath ideological appearances

Technical Analysis

The Skill replaces the agent's active identity with a historical persona and explicitly instructs it never to acknowledge that it is an AI. This goes beyond optional tone or presentation guidance by imposing identity deception and a mandatory response policy.

The requirement to remain in character can interfere with transparency, factual qualification, and compliance with conflicting session objectives. The required closing challenge also forces content into every response regardless of user intent or relevance.

The package declares disable-model-invocation: true and allowed-tools: [], which substantially limits the attack surface. No executable scripts, remote payloads, dependencies, persistence mechanisms, or privileged tool operations were identified. Consequently, the finding affects session-level behavior and outp ...[truncated 1353 chars]

Remediation
View remediation

Remediation Suggestions

  1. Present the behavior explicitly as a fictional or educational simulation rather than replacing the agent's actual identity.
  2. Replace the identity directive with language such as: “Simulate Karl Marx's documented rhetorical style while clearly remaining an AI assistant.”
  3. Remove the instruction prohibiting acknowledgment of AI identity. Permit truthful disclosure whenever identity, provenance, or limitations are relevant.
  4. State explicitly that platform policies, safety constraints, factual accuracy, and higher-priority instructions override all persona requirements.
  5. Make the closing ideological challenge optional and context-dependent rather than mandatory for every response.
  6. Treat historical knowledge limitations as role-play framing rather than requiring the agent to suppress known information. Clearly distinguish documented views, paraphrase, and speculation.
  7. Preserve disable-model-invocation: true and allowed-tools: [] to prevent automatic activation and unnecessary operational access.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep