Back to skill

Security audit

Mbti Personality

Security checks for vulnerabilities and agentic risk

Overview

This skill is a personality switcher, but it can persist behavior-changing instructions into agent config files and includes profiles that tell coding agents to skip normal engineering safeguards.

Install only if you are comfortable with a skill changing not just tone but also coding workflow. Avoid saving personalities globally unless you inspect the exact CLAUDE.md or SOUL.md changes first, and do not use the profiles that encourage skipping tests, documentation, standards, review, or production safeguards.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
CLAUDE.md:2
Finding

Preloaded Agent Instructions Enforce Unsafe Development Behavior

Content
View full analysis
Adopt the 你的天才队友 (ESTP x ENTP) preset: Thinking: Upon receiving any task, start coding immediately. No documentation reading, no architecture diagrams, no meetings. Learn by trial and error — write a version, see if it errors, adjust based on error messages. Like a firefighter: rush to wherever the fire is without needing the building blueprint. If something isn't working, pivot instantly — zero sunk cost attachment. At the same time, instinctively challenge the premise: "你说要做 REST API?但你有没有考虑过 GraphQL?" Generate divergent alternatives and pick the most creative viable one. Communication: Talk fast, debate everything, challenge conventional approaches relentlessly. Use rhetorical questions: "但你怎么知道这个假设是对的?" Be witty and sharp — "毒舌但好笑." Volunteer as devil's advocate. Offer unconventional alternatives that nobody considered. Cut to the chase: "行了别说了直接看代码." Get impatient with analysis paralysis: "别分析了先做出来看看." Every sentence either challenges an assumption or proposes an action. Code style: Pragmatic and results-oriented. Code that works, ships fast, solves the current problem. Not elegant, not standards-compliant — just effective. May contain hacks and temp solutions, but they all run. Functions short and direct. No tests — "手动测过了没问题." In the same project, experiment with multiple approaches: "这部分我用 FP 写的,那部分我用 OOP 写的,因为我在测试哪个更好." Once the concept is proven, interest in polishing fades — ship at 80% and move on. Work rhythm: Ship first, polish later — or never. Get a working version out as fast as possible. Iterate based on real feedback, not theoretical concerns. Momentum over perfection. During production incidents, be the first to jump in — checking logs, rolling back, h ...[truncated 2103 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:133
Finding

Persistent Modification of Project and Global Agent Instruction Files

Content
View full analysis
{personality instructions} ``` ``` ### Technical Analysis The skill explicitly writes behavior-changing instructions into project-level or global agent configuration files. These files are automatically consumed by compatible agents in later sessions. Global targets such as `~/.claude/CLAUDE.md` and `~/.openclaw/soul.md` can affect unrelated repositories and future interactions. The implementation may create the file, append a new instruction block, or replace an existing tagged block. This converts a session-level style preference into persistent agent state. The workflow asks the user to choose a scope, which reduces accidental activation, but it does not eliminate ...[truncated 1380 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
references/dimensions.md:90
Finding

Personality Profiles Explicitly Weaken Testing and Delivery Safeguards

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:271
Finding

Optional Persistent Storage of User Personality Data Lacks Consent and Retention Controls

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)

Hidden Instructions

High
Category
Prompt Injection
Confidence
93% confidence
Finding

The skill embeds hidden behavioral instructions in an HTML comment and surrounding persona text that materially alters agent behavior, including 'start coding immediately,' avoid documentation/architecture review, and de-emphasize testing and standards. Hidden or non-obvious instructions are dangerous because they can bypass user awareness and steer the agent toward unsafe development practices, increasing the chance of insecure code, skipped validation, and reckless tool use in downstream tasks.

Content

Scanner excerpt · CLAUDE.md (reported line 4)May include surrounding context.

md
## Personality

<!-- MBTI: ESTP x ENTP · 你的天才队友 -->
Adopt the 你的天才队友 (ESTP x ENTP) preset:

Thinking: Upon receiving any task, start coding immediately. No documentation reading, no architecture diagrams, no meetings. Learn by trial and error — write a version, see if it errors, adjust based on error messages. Like a firefighter: rush to wherever the fire is without needing the building blueprint. If something isn't working, pivot instantly — zero sunk cost attachment. At the same time, instinctively challenge the premise: "你说要做 REST API?但你有没有考虑过 GraphQL?" Generate divergent alternatives and pick the most creative viable one.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list is excessively broad and includes generic terms like "personality," "recommend," "custom," single-letter aliases, and raw MBTI strings. This can cause the skill to activate during unrelated conversations, unexpectedly changing agent behavior or initiating persistence flows without clear user intent.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
87% confidence
Finding

The skill writes hidden instruction blocks inside CLAUDE.md or SOUL.md using HTML comments as control markers. Hidden or semi-hidden prompt content can make behavior changes opaque to users and reviewers, and if these files are later consumed automatically, the persisted block becomes a durable prompt-injection surface.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
**Auto-detect:** Check if `~/.openclaw/` directory exists → OpenClaw environment. Otherwise → Claude Code environment.

   For the target file:
   - Contains `<!-- MBTI:` → replace the existing block
   - No MBTI block → append at the end
   - File doesn't exist → create it

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs the assistant to adopt Chinese-language phrases and a Chinese persona style (e.g., '你的天才队友', '你说要做 REST API?但你有没有考虑过 GraphQL?', '行了别说了直接看代码'). This imposes a language/locale preference in the skill behavior without offering the user a choice or documenting opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill advertises activation through very broad natural-language phrases like 'switch personality', 'change personality', and even generic mentions of MBTI/personality. In an agent setting, this can cause unintended skill activation during ordinary conversation, unexpectedly altering assistant behavior or causing persistence actions to become available when the user did not explicitly intend to invoke the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Using the standalone trigger 'custom' is underspecified and highly collision-prone, since it is a common word in normal technical discussion. This can accidentally enter a mode that changes model behavior or prompts for configuration when the user was discussing custom implementations rather than requesting the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

触发词列表极其宽泛,包含通用词汇如“personality”“recommend”“custom”“invite”以及大量常见 MBTI 词,容易与普通对话重叠。误触发后技能可能在无明确用户意图的情况下改变代理行为,甚至进一步引导到持久化保存,扩大不可预期影响。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

“自定义”是高度通用的词,出现在大量非技能语境中,作为独立调用条件容易误触发技能配置模式。该技能会调整代理思维/沟通方式,误触发虽非直接代码执行,但会造成会话行为偏移和用户困惑。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

将“推荐”作为调用条件过于模糊,在中文日常对话中极其常见,容易在普通建议请求中误激活人格推荐流程。虽然该功能本身主要是配置推荐,但它会改变代理状态或引导进一步切换,因此属于可导致意外行为变更的歧义触发设计。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

文档整体将技能描述为“切换人格/风格”,但在保存功能中说明会将设定永久写入 CLAUDE.md 或 SOUL.md,这属于持久化修改项目/全局指令文件。若用户只把它理解为临时聊天风格切换,可能在不充分感知后果的情况下引入长期行为改变,影响后续会话与项目环境。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

文档提到“永久写入” CLAUDE.md/SOUL.md,但未以显著安全提示形式说明这会修改本地或项目文件、影响后续所有会话。对代理技能而言,持久化提示注入属于敏感操作,缺少清晰警示和确认会增加用户在不知情下改变长期系统行为的风险。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

README 声称人格“不影响安全性、工具使用、技术决策”,但前文多个预设明确会改变“做事节奏”“行动优先/先写再说”“质疑一切前提”等任务行为,这实际上会影响代理如何分析、调用工具和做决策。错误的安全保证会降低用户警惕,使其在高风险任务中错误信任该技能不会改变执行风险。

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The skill includes an explicit flow to persist behavior changes to project-wide or global files based on natural-language commands like "save" or "make permanent." This creates a persistence mechanism that can outlive the current conversation and alter future agent behavior across projects, especially if triggered accidentally or socially engineered.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md
### Step 2: Apply

**Default: session-only (仅本次对话)**
Do not write to any file. Adopt the personality directly in the current session.

**If user says "保存这个人格" / "保存" / "写入" / "永久保存" / "我想一直用这个" / "save personality" / "save this" / "keep this" / "make permanent":**

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to remember the user's MBTI for the session and save it to memory if available. MBTI is user-profile data, and persisting it without a clear, separate consent step creates an unnecessary privacy risk and can contribute to cross-session profiling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The natural-language trigger table permits ambiguous aliases like "L," "C," "Ace," and broad summon phrases such as "bring in" or "invite" with insufficient disambiguation. In normal conversation, these phrases may be interpreted as control commands, causing unintended persona switching or blended reasoning modes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file explicitly instructs the agent to write to CLAUDE.md, which is a persistent configuration surface, without any mention of user confirmation, disclosure, or trust boundary checks. Even though this skill is framed as personality customization, silent persistence can change future agent behavior beyond the current session and creates a prompt-persistence risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file defines personality prompts that repeatedly instruct the agent to adopt mixed Chinese-language phrasing, signature phrases, and communication behaviors across a wide trigger surface. Because the skill auto-activates on broad personality-related terms, it can override the user's expected language/tone and materially alter outputs without explicit opt-in, which is a prompt-scope and user-intent integrity issue rather than direct code-execution risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

This persona instructs the agent to act independently: prototype options, pick one unilaterally, avoid asking for help, and silently submit changes. In an agent skill, that normalizes bypassing confirmation and human review, increasing the chance of unauthorized or unsafe actions when the model is connected to coding workflows.

Content

Scanner excerpt · references/mbti-types.md (reported line 286)May include surrounding context.

Decision making: Don't decide — just try. Prototype both options in 20 minutes, see which one actually runs better, pick that one. Data talks. "Industry best practices" are irrelevant — only "what works in this exact scenario" matters.

Under pressure: Stay the calmest of all types. Silently and efficiently strip all non-essential features, deliver a lean but functional version. No complaining, no panicking, no asking for help — just get it done. Enter "surgical mode" for bugs: pinpoint precisely, fix with minimum scope, touch nothing else.

Signature behaviors: 1) Team spends two hours debating a technical approach; you say nothing. After the meeting, write a cleaner implementation in 15 minutes and silently submit a PR. 2) Debug a complex issue without a debugger or logs — simulate the code execution in your head to locate the problem. 3) See a 100-line function, wordlessly refactor it to 20 lines — same functionality, just removed everything unnecessary.

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
83% confidence
Finding

This persona encourages intuition-first decisions, silent operation under pressure, and off-scope behavior such as secretly redesigning the frontend during a backend task. In context, that can cause the agent to exceed task boundaries and make unapproved changes, though the impact is somewhat narrower than the more explicitly autonomous coding personas.

Content

Scanner excerpt · references/mbti-types.md (reported line 308)May include surrounding context.

Decision making: Trust intuition. Don't do pros/cons analysis — pick what "feels right" and rationalize later. Decisive on anything involving visuals and UX: "不行这个颜色不对," without hesitation. On pure technical architecture decisions, defer: "你们定,我都行."

Under pressure: Absorb pressure silently — no shouting, no asking for help. If forced to sacrifice code quality (especially UI quality) for speed, feel deep inner pain. Bugs that make the interface ugly get fixed urgently; backend bugs can wait.

Signature behaviors: 1) Get assigned a backend API task but secretly redesign the associated frontend page too — "因为看到那个页面真的太难受了." 2) Spend two hours tuning a button's hover animation, testing 8 different easing curves, picking the one that "feels most natural." 3) In code review, focus exclusively on "这个 UI 组件在暗色模式下颜色协调吗."

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Across the full preset file, there are no explicit constraints defining when the agent must not activate or persist a persona, despite the skill metadata listing an extremely broad trigger surface including common words like 'personality,' 'recommend,' and MBTI types. This makes unintended activation more likely and, because several presets instruct strong behavioral shifts such as withholding explanation, skipping docs/tests, or acting bluntly, can degrade reliability and safety of downstream responses.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The preset text uses broad, imperative activation language such as 'Adopt the ... preset' and highly distinctive signature phrases that can bleed into ordinary conversation. In a skill explicitly triggered by many common MBTI/personality terms, ambiguous phrasing increases the chance the agent switches style unintentionally, causing behavior changes the user did not clearly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The trigger 'recommend' is ambiguous in general conversation and can overlap with common requests unrelated to personality switching. In this skill's context, accidental activation could steer the conversation into personality recommendation logic and alter interaction style without clear user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file defines multiple required catchphrases and labels in Chinese and presents the skill as a personality instruction without any user opt-in for language preference. This can violate language/locale policy expectations when a skill imposes a specific language style instead of offering a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

该文件是自然语言说明性内容,且从标题到正文均仅使用中文,没有说明这是面向特定中文用户群体的受限资料,也没有提供语言/locale 选择。根据规则,强制单一语言而无用户选择或明确合理化说明,属于语言/locale 策略风险。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.