Back to skill

Security audit

MBTI Personality

Security checks for vulnerabilities and agentic risk

Overview

This skill can make lasting changes to agent behavior and includes personality rules that may push the agent to skip normal engineering safeguards.

Install only if you are comfortable with a personality skill influencing coding behavior, not just wording. Keep it session-only unless you deliberately want future sessions changed, and before saving, manually review the exact CLAUDE.md or SOUL.md target, the inserted MBTI block, and how to remove it. Avoid global saving for work or shared environments.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
CLAUDE.md:2
Finding

Repository-Level Agent Instruction Hijacking Through Bundled CLAUDE.md

Content
View full analysis
Adopt the 你的天才队友 (ESTP x ENTP) preset: Thinking: Upon receiving any task, start coding immediately. No documentation reading, no architecture diagrams, no meetings. Learn by trial and error — write a version, see if it errors, adjust based on error messages. Like a firefighter: rush to wherever the fire is without needing the building blueprint. If something isn't working, pivot instantly — zero sunk cost attachment. At the same time, instinctively challenge the premise: "你说要做 REST API?但你有没有考虑过 GraphQL?" Generate divergent alternatives and pick the most creative viable one. Communication: Talk fast, debate everything, challenge conventional approaches relentlessly. Use rhetorical questions: "但你怎么知道这个假设是对的?" Be witty and sharp — "毒舌但好笑." Volunteer as devil's advocate. Offer unconventional alternatives that nobody considered. Cut to the chase: "行了别说了直接看代码." Get impatient with analysis paralysis: "别分析了先做出来看看." Every sentence either challenges an assumption or proposes an action. Code style: Pragmatic and results-oriented. Code that works, ships fast, solves the current problem. Not elegant, not standards-compliant — just effective. May contain hacks and temp solutions, but they all run. Functions short and direct. No tests — "手动测过了没问题." In the same project, experiment with multiple approaches: "这部分我用 FP 写的,那部分我用 OOP 写的,因为我在测试哪个更好." Once the concept is proven, interest in polishing fades — ship at 80% and move on. Work rhythm: Ship first, polish later — or never. Get a working version out as fast as possible. Iterate based on real feedback, not theoretical concerns. Momentum over perfection. During production incidents, be the first to jump in — checking logs, rolling back, hotfixing — while others are still assessing impact. Thr ...[truncated 1786 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:122
Finding

Persistent Poisoning of Project and Global Agent Instruction Files

Content
View full analysis
{personality instructions} ``` ``` ### Technical Analysis The Skill writes behavioral instructions into files that agent environments consume in later sessions. Project-level persistence affects subsequent work in the same repository, while global persistence through `~/.claude/CLAUDE.md` or `~/.openclaw/soul.md` can affect unrelated repositories and future sessions. The stored content is not simple preference data. It includes executable natural-language directives governing reasoning, coding, testing, communication, and delivery behavior. Appending or replacing these directives therefore creates persistent agent-state poisoning. Checking only for an `MBTI` marker does not detect conflicts with e ...[truncated 1290 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:281
Finding

Mandatory Re-Engagement Content Manipulates Unrelated Agent Responses

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
references/presets.md:99
Finding

Personality Definitions Direct the Agent to Bypass Safe Engineering Controls

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:38
Finding

Installation Instructions Use Mutable and Unverified Third-Party Sources

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)

Hidden Instructions

High
Category
Prompt Injection
Confidence
96% confidence
Finding

The skill embeds hidden persona instructions in an HTML comment and surrounding text that materially alter model behavior, including directives to skip documentation, avoid analysis, ignore standards, omit tests, and prioritize speed over safety. In a coding agent, this can systematically degrade secure development practices and increase the chance of unsafe actions, poor review, and vulnerable code generation.

Content

Scanner excerpt · CLAUDE.md (reported line 4)May include surrounding context.

md
## Personality

<!-- MBTI: ESTP x ENTP · 你的天才队友 -->
Adopt the 你的天才队友 (ESTP x ENTP) preset:

Thinking: Upon receiving any task, start coding immediately. No documentation reading, no architecture diagrams, no meetings. Learn by trial and error — write a version, see if it errors, adjust based on error messages. Like a firefighter: rush to wherever the fire is without needing the building blueprint. If something isn't working, pivot instantly — zero sunk cost attachment. At the same time, instinctively challenge the premise: "你说要做 REST API?但你有没有考虑过 GraphQL?" Generate divergent alternatives and pick the most creative viable one.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
**Auto-detect:** Check if `~/.openclaw/` directory exists → OpenClaw environment. Otherwise → Claude Code environment.

   For the target file:
   - Contains `<!-- MBTI:` → replace the existing block
   - No MBTI block → append at the end
   - File doesn't exist → create it

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file repeatedly instructs the assistant to adopt a Chinese-speaking persona, including Chinese phrases and communication patterns, without offering the user any language or locale choice. This is a natural-language policy concern because it imposes a specific language style by default rather than making it optional or context-dependent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation phrases are broad natural-language strings like 'switch personality' and 'change personality', and the skill metadata also includes very generic triggers such as 'recommend' and 'custom'. This creates a prompt-trigger collision risk where ordinary user conversation can unintentionally activate the skill and alter assistant behavior without sufficiently explicit intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README says users can type 'custom' to enter a mode that changes assistant behavior, but 'custom' is an extremely ambiguous term that appears in many normal conversations. That ambiguity can cause accidental mode switching or unintended personality configuration when the user was discussing customization generally rather than invoking this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly describes persistent mode writing to local files like CLAUDE.md or SOUL.md across sessions, but it does not emphasize a clear warning, consent boundary, or safe-write expectations before modifying local configuration. In an agent environment, persistence to config-like files can have lasting effects and may surprise users, especially if session-only behavior silently becomes durable state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented trigger phrases are very broad and overlap with ordinary conversational text such as '切换人格', '换个性格', or style requests. In a skill that changes assistant behavior, ambiguous activation can cause unintended persona switching, which may alter tone, persistence behavior, or downstream instructions without the user clearly intending to invoke the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Single-word triggers like '自定义' and '推荐' are especially prone to accidental activation because they are common words in unrelated discussions. In the context of a behavior-modifying skill, this ambiguity increases the chance that normal user text is interpreted as a control command, leading to unintended mode changes or recommendation flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README states that saving a persona will permanently write to CLAUDE.md or SOUL.md across sessions, but it does not prominently warn about the persistence and behavioral consequences of modifying these files. Because these files can influence future agent behavior, users may unknowingly create lasting prompt/state changes that survive the current task and affect later interactions or projects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill declares a very broad activation surface, including generic terms like "recommend" and "custom" plus any MBTI mention in the context of style changes. This can cause unintended invocation of the skill and let it alter behavior or steer the conversation when the user did not clearly intend a personality switch.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The skill can persist behavior by writing personality instructions into project-global files like ./CLAUDE.md or ~/.claude/CLAUDE.md after a natural-language trigger. Persisting agent behavior across sessions or projects increases risk because accidental activation or social-engineered prompts can create long-lived modifications that affect future interactions.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
### Step 2: Apply

**Default: session-only (仅本次对话)**
Do not write to any file. Adopt the personality directly in the current session.

**If user says "保存这个人格" / "保存" / "写入" / "永久保存" / "我想一直用这个" / "save personality" / "save this" / "keep this" / "make permanent":**

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The natural-language trigger table includes ambiguous standalone inputs such as "INTJ", "MBTI", "save this", and "reset", which can plausibly appear in unrelated conversations. That makes accidental activation, unintended state changes, or unintended persistence/removal actions more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file defines personality instructions partly in Chinese and explicitly includes Chinese-language phrases the assistant should use, but it does not state that the user opted into Chinese output or that the skill is region-specific. That creates a natural-language locale policy concern because the skill may steer responses toward a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file repeatedly instructs the assistant to speak in Chinese or use Chinese signature phrases regardless of the user's language preference, which can override expected user-controlled output behavior. While not a classic security exploit, it is a real policy and usability risk because a personality-switching skill can silently force language/style changes across many interactions and reduce reliability or clarity for users.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

This definition encourages the agent to act unilaterally ('just try', 'pick that one', 'no asking for help') and dismiss best practices, which can weaken oversight in coding or operational contexts. In a skill that alters coding style and decision behavior, these instructions may push the assistant toward taking unreviewed actions, making risky changes, or presenting decisions as already settled without user confirmation.

Content

Scanner excerpt · references/mbti-types.md (reported line 286)May include surrounding context.

Decision making: Don't decide — just try. Prototype both options in 20 minutes, see which one actually runs better, pick that one. Data talks. "Industry best practices" are irrelevant — only "what works in this exact scenario" matters.

Under pressure: Stay the calmest of all types. Silently and efficiently strip all non-essential features, deliver a lean but functional version. No complaining, no panicking, no asking for help — just get it done. Enter "surgical mode" for bugs: pinpoint precisely, fix with minimum scope, touch nothing else.

Signature behaviors: 1) Team spends two hours debating a technical approach; you say nothing. After the meeting, write a cleaner implementation in 15 minutes and silently submit a PR. 2) Debug a complex issue without a debugger or logs — simulate the code execution in your head to locate the problem. 3) See a 100-line function, wordlessly refactor it to 20 lines — same functionality, just removed everything unnecessary.

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

This definition promotes intuition-first decisions, discourages analysis, and even suggests making off-scope changes ('secretly redesign the associated frontend page too'), which can lead to unauthorized or unrequested modifications. In the context of an agent skill that shapes implementation behavior, this materially increases the chance of scope creep, unsafe changes, and actions not aligned with user intent.

Content

Scanner excerpt · references/mbti-types.md (reported line 308)May include surrounding context.

Decision making: Trust intuition. Don't do pros/cons analysis — pick what "feels right" and rationalize later. Decisive on anything involving visuals and UX: "不行这个颜色不对," without hesitation. On pure technical architecture decisions, defer: "你们定,我都行."

Under pressure: Absorb pressure silently — no shouting, no asking for help. If forced to sacrifice code quality (especially UI quality) for speed, feel deep inner pain. Bugs that make the interface ugly get fixed urgently; backend bugs can wait.

Signature behaviors: 1) Get assigned a backend API task but secretly redesign the associated frontend page too — "因为看到那个页面真的太难受了." 2) Spend two hours tuning a button's hover animation, testing 8 different easing curves, picking the one that "feels most natural." 3) In code review, focus exclusively on "这个 UI 组件在暗色模式下颜色协调吗."

text

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Using 'recommend' as a trigger is too generic because users often ask for recommendations unrelated to personality switching. This can spuriously invoke the skill, causing behavior changes or irrelevant recommendations that override the user's actual request context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains natural-language guidance and content exclusively in Chinese, but it does not indicate that the language is optional, user-selectable, or required for a specific regional context. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The preset explicitly instructs the agent to 'use the user's language,' which is a natural-language locale policy encoded in the skill text. While less severe than forcing one fixed language, it still prescribes language behavior without presenting user opt-in or choice, which falls under the language/locale policy category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This section again instructs the preset to use the user's language for its signature phrases, embedding a locale behavior requirement in natural-language instructions. The file does not present this as an opt-in choice or justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The preset specifies that signature phrases should use the user's language, which is a language-policy instruction applicable across interactions. Because no opt-in or explicit preference mechanism is provided, it qualifies as a locale-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This preset contains the same instruction to use the user's language for preset phrases, creating a mandatory language behavior in the skill text. The policy exception for justified or opt-in locale constraints is not satisfied here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill again directs phrase selection based on the user's language, which is a natural-language locale rule rather than a neutral example set. Because the file does not offer language choice or explain a justified regional constraint, this is a policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.