Back to skill

Security audit

Wanxiang Scroll Personality

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only Chinese creative-writing reference skill with no code or system access, though it includes adult-roleplay mechanics and visible reasoning templates users should review.

Install only if you want a Chinese-language interactive-story/personality reference module and are comfortable with adult roleplay-related mechanics in its reference files. It does not contain executable code or request system access, but users should avoid applying the visible thinking template as hidden reasoning output.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/index.md (reported line 1)May include surrounding context.

md
# 第十章:系统人格配置

## 概述

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file is entirely framed as mandatory Chinese output rules, including Chinese-only structure and examples, but it does not indicate that the user can opt into another language or that the skill is intentionally limited to a Chinese-language context. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

SQP-3 applies to all file types and covers natural-language language/locale policy violations. This markdown file presents all instructions exclusively in Chinese and does not provide user opt-in, alternatives, or documentation that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This section goes beyond neutral writing-quality guidance and introduces explicit sexual arousal/orgasm mechanics with quantified thresholds and trigger conditions. In a personality/creative-writing skill, that creates structured support for erotic sexual content generation, which can increase the likelihood of producing disallowed or unsafe sexual material, especially if used with broad user inputs or roleplay contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all instructions and templates exclusively in Chinese, and nowhere indicates that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. The policy explicitly calls out forced language or locale constraints without user opt-in as a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the model to emit a visible block containing internal reasoning steps, task analysis, and compliance checks. Exposing chain-of-thought can leak hidden reasoning, system-behavior cues, and policy-handling logic that should remain internal, and it is not necessary for a creative-tools module to function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This file contains natural-language instructions and descriptive content exclusively in Chinese, and there is no visible opt-in or alternative language path. Under the policy rule, forcing a specific language without user choice can be a locale-policy issue unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.