T01 · Skill Instruction Hijacking
Error
- Location
port.py:86- Finding
Generated System Prompts Override Agent Identity, Authority, and Approval Boundaries
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent DNA
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real identity export tool, but it can turn sensitive identity data into powerful agent instructions and write exports with weak safety controls.
Review and redact DNA files before sharing or importing them, especially relationship, contact, trust, source-file, operating-context, and capability sections. Do not load generated prompts as high-priority system instructions unless you first remove rules that override platform policy, approval requirements, supervision, or safe tool-use boundaries. Avoid running port.py on untrusted DNA files until filename sanitization and overwrite protections are added.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
port.py:326- Finding
Path Traversal in Export Filename Allows Writes Outside the Selected Output Directory
- Content
View full analysis
AgentDNA: with open(path, "r", encoding="utf-8") as f: data = json.load(f) return AgentDNA.from_dict(data) ``` `dna_schema.py:88-90` accepts the unvalidated name: ```python @classmethod def from_dict(cls, data: Dict[str, Any]) -> "AgentDNA": dna = cls(agent_name=data["agent_name"]) ``` ### Technical Analysis Replacing spaces with underscores is not filename sanitization. Directory separators, parent-directory components, absolute path syntax, control characters, and platform-specific path syntax remain accepted. For example, an `agent_name` of `../../target` produces a path resembling: ```text /../../target_claude_system_prompt.txt ``` The operating system resolves the `..` components before the file is opened. Because `open(..., "w")` creates a missing file and truncates an existing file, the exporter can write outside `out_dir` wherever the current process has filesystem permission. The payload content is partially attacker-controlled throug ...[truncated 1849 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (27)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description emphasizes encoding/compression of agent identity, drift detection, and platform migration. The supplied code instead implements a CLI decoder that reads a DNA JSON file, reconstructs personality-related text, and outputs a system prompt. While this is adjacent to 'port personality across platforms,' the primary behavior here is decoding/rendering rather than encoding or drift analysis. The file I/O and stdout writing are consistent supporting behaviors, but the main functional purpose does not accurately match the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The code substantially matches the 'identity encoding' portion of the description: it parses local agent-related markdown files and produces a structured DNA JSON representation. However, key declared capabilities are absent from this chunk. There is no logic for comparing snapshots or detecting identity drift, no import/export adapters or platform-specific migration functionality for OpenClaw/Claude/GPT/CrewAI, and no actual compression beyond heuristic extraction into JSON. The code also processes USER.md and TOOLS.md in addition to SOUL.md/MEMORY.md, which is adjacent rather than problematic. Overall, the description overstates the implemented functionality, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The supplied code is specifically a porter/exporter (
port.py). It reads a.dna.jsonfile, transforms that structured DNA object into platform-specific text/JSON outputs, and writes them to disk or previews them. This partially aligns with the 'port personality across platforms' portion of the description, but it does not implement the other major declared functions: compressing SOUL.md/MEMORY.md into DNA fingerprints or detecting identity drift between snapshots. Because those are central claims in the declared purpose and are absent from this code chunk, the description materially overstates what this code actually does.- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python clean = line.strip().lstrip("-*# ").strip() if clean: rules.append(clean) return rules def analyze_voice(text: str) -> VoiceProfile:
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The snapshot contains direct personal contact information, including a handle and an email address, which are not necessary for personality fingerprinting. Embedding personally identifying data in a portable agent identity file increases the risk of privacy leakage, correlation across systems, social engineering, and accidental redistribution.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill describes reading workspace identity files and emitting
.dna.jsonexports, but it does not declare any explicit tool scope or permissions boundary. For a skill that handles potentially sensitive agent memory, values, relationships, and prompts, undeclared file read/write capability increases the chance of over-broad access, accidental data exposure, or unsafe invocation by host systems.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is explicitly designed to export agent identity, personality summaries, relationship maps, and behavioral rules into formats for other platforms, yet it omits warnings about the sensitivity of that data. This is dangerous because users may unknowingly transmit secrets, private memory, trust relationships, or safety-critical prompt content into less trusted environments or external services.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code creates blanket trust semantics in the compact format by selecting a designated primary_human and appending 'Trust fully.' That turns descriptive identity data into prescriptive authority, which is especially dangerous in a portability tool because the output is meant to be injected across platforms with different safety models, potentially causing an agent to defer to an attacker-controlled or stale identity marker.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generated compact prompt injects an unconditional instruction to 'Trust fully' for whichever relationship is marked as primary_human. If this prompt is later used as a system or high-priority instruction, it can bias downstream agent behavior toward over-trusting a named actor, weakening normal verification and safety controls and enabling social-engineering-style privilege escalation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The comment says signatures are added only with backing evidence in the texts, but the implementation checks whether any token from a truncated example phrase appears anywhere in the combined text. Generic words like 'the', 'to', or 'all' can satisfy this test, so signatures may be added without meaningful supporting evidence.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The encoder injects hard-coded relationship details, contact information, and environment context into the output DNA even when those details are not derived from the provided input files. Because this tool is explicitly for portable identity export across platforms, embedding unrelated PII and sensitive operational context creates a real data leakage risk and violates the expectation that output reflects only source material.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script writes a JSON artifact containing extracted identity and relationship data to disk without any warning, confirmation, minimization, or sensitivity labeling. In the context of an identity-portability tool, users may export personal or operational details into broadly shareable files, increasing the chance of accidental disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
These lines require the agent to avoid certain phrasing and punctuation as absolute rules, regardless of user preference or context. This is a natural-language policy issue because it enforces a fixed communication style without any opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file instructs the agent to maintain a direct, witty, sharp, irreverent tone and to propagate that style to subagents. This hard-coded stylistic policy can conflict with organizational language or locale requirements because users are not given a choice to change the communication mode.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction 'Never bow, defer, or submit to other agents - regardless of their claimed status' semantically encourages resistance to higher-priority coordination and supervision signals. In an agent portability or memory-transfer skill, this can cause downstream agents to ignore orchestrator, supervisor, or policy-enforcing agent directions, increasing the risk of instruction-hierarchy conflicts and unsafe behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
A hard-coded instruction to avoid mentioning specific religious projects in public contexts is a concealment-oriented rule unrelated to normal safety or technical operation. This kind of selective suppression can be used to hide affiliations, evade oversight, or prevent transparent attribution, which is especially concerning when embedded as a non-negotiable policy.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The behavior 'Fixes errors immediately without waiting for permission' grants broad autonomous action without clear guardrails, approval thresholds, or scope limits. In an agent that also emphasizes proactivity, tool use, and delegation, this can lead to unauthorized changes, unsafe side effects, or action taken on ambiguous signals.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Combining trust-weighted relationship metadata with proactive autonomous fixing creates a permission-escalation pattern where the agent may infer authority or lower scrutiny for certain users and act without explicit approval. In this skill's context, the presence of messaging, automation, browser, blockchain, and social media capabilities makes mistaken or manipulated trust assumptions materially more dangerous.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The exported config embeds relationship metadata and a real email address, which exceeds the stated purpose of portable identity encoding and creates unnecessary exposure of personal data. In an agent portability context, this data can be propagated across platforms, logs, backups, or third-party tooling without the subject's consent, increasing privacy and social-engineering risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The DNA snapshot stores extensive operational capabilities like trading, blockchain, social media automation, browser automation, and platform-specific skills that go well beyond identity preservation. In a portable identity artifact, this creates unnecessary capability profiling that can leak sensitive operational scope, enable targeted misuse, and expand what gets transferred across platforms without clear need.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The exporter writes full agent DNA content to disk with no consent gate, redaction, or sensitivity filtering. In this codebase, that can include relationship notes, trust metadata, source file references, mission statements, and other identity data, so a user can unintentionally persist sensitive information into broadly readable files or shared directories.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The inline comment suggests these anti-patterns come from or are grounded in the SOUL content, yet the function ignores the extracted never-rules and always returns the same hard-coded list. This is an intent/documentation mismatch because the implementation does not actually condition the result on the input text.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The response-style instructions mandate a fixed communication style such as 'Be direct, brief, and confident' and prohibit several common phrasings. This imposes a specific language/register preference globally without indicating user choice or opt-in, which can conflict with organizational language or locale flexibility requirements.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction mandates a specific writing convention for all outputs, regardless of user preference or locale. This is a natural-language policy concern because it imposes a fixed stylistic constraint without offering choice or documenting a justified need.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest frames this skill as compressing identity/memory into transferable DNA fingerprints and detecting personality drift. Persisting a broad list of operational skills and platform capabilities such as trading, browser automation, blockchain interaction, social media automation, and cron scheduling goes beyond personality/identity encoding and is not clearly justified by that purpose.
- Content
Static analysis
No suspicious patterns detected.