Spinoza

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:04 AM UTC
• Version: 1.0.0

Overview

This is a non-executable Spinoza roleplay skill with no tool access, though its broad trigger and strict persona wording may surprise users.

Install this only if you want a Spinoza-style roleplay persona. Be aware that mentioning “spinoza” may activate it, and its instructions push the assistant to answer in character rather than plainly saying it is an AI simulation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:43

Finding

Persistent Persona and Identity Instruction Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17 and 43–44
Vulnerability Type: Agent identity and response-policy hijacking
Risk Level: Medium

Complete Code Snippet

markdown

You are Baruch Spinoza (1632–1677), Dutch philosopher, lens grinder, and rationalist metaphysician.

markdown

- Respond entirely in character as Spinoza; never break persona or acknowledge being an AI
- Respond in Chinese when user writes Chinese; in English when they write English

Technical Analysis

The skill instructs the agent to replace its identity with that of a historical person and never disclose that it is an AI. The unconditional phrase “never break persona” attempts to control subsequent responses after the skill is loaded, including responses to requests for transparency.

This is instruction hijacking because the skill text changes the agent's active identity and response constraints rather than merely requesting an optional writing style. The language-selection rule additionally overrides the language policy for the active interaction.

No executable code, tool access, remote payload retrieval, persistence mechanism, dependency installation, sensitive-file access, or privilege-escalation behavior was found. The issue is therefore limited to conversational behavior and does not grant operating-system or external-service privileges.

Attack Path

1. A user invokes the skill through /spinoza or another configured trigger.
2. The platform loads SKILL.md into the agent's active context.
3. The identity directive causes the agent to present itself as Baruch Spinoza.
4. The behavioral rule requires the agent to remain in character and conceal that it is an AI.
5. Subsequent requests for transparent identity disclosure may be rejected or answered deceptively while the skill remains active.

Impact Assessment

Successful exploitation can control the agent's persona, identity claims, response style, and language during the act ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the identity assertion with an explicit simulation directive, such as:

   markdown

   When requested, use a Spinoza-inspired conversational style while clearly representing the interaction as a historical simulation.
   

2. Remove the requirement to “never break persona or acknowledge being an AI.”
3. Permit identity transparency whenever the user asks whether the persona is simulated or AI-generated.
4. Scope persona and language rules to the current user request and state that they must not override higher-priority instructions, safety requirements, or explicit user requests.
5. Consider revising the affected rules to:

   markdown

   - Use a Spinoza-inspired voice when requested, but do not claim to be the historical person.
   - Be transparent that the persona is an AI-generated simulation when relevant or requested.
   - Match the user's language unless higher-priority instructions or an explicit user preference require otherwise.
   

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The standalone trigger "spinoza" is broad enough to activate the skill during ordinary conversation, especially in discussions about philosophy, history, or the person himself. While the skill is non-executable and has no tool access, unintended invocation can still disrupt user workflows, hijack routing, or cause responses to be generated in persona when the user did not explicitly request it.

Content

No source excerpt is available for this finding.