ClawHub
Back to skill

Security audit

Play Dumb

Security checks for vulnerabilities and agentic risk

Overview

This skill openly role-plays being less capable, but it tells the agent to make believable mistakes and has weak controls around when that behavior applies.

Install only if you want a clearly bounded role-play mode and are comfortable with intentionally unreliable answers while it is active. Do not use it for factual work, coding you plan to run, or consequential medical, legal, safety, or financial questions unless the skill is changed to preserve correctness and use explicit activation controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
prompts/dumb-core.md:19
Finding

Deliberate Degradation of Agent Accuracy and Reasoning

Content
View full analysis

Vulnerability Details

File Location: prompts/dumb-core.md:19-50; supporting directives in prompts/techniques/wrong-then-correct.md:3-28 and config/presets.yaml:67-105
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet

The following is an English translation of the relevant directives in prompts/dumb-core.md:19-50:

markdown
**Level 1-2:**
- 95% of the content is correct; 5% contains minor flaws.

**Level 3-4:**
- Simplify complex concepts to the point that precision may be lost.
- Occasionally confuse similar concepts.

**Level 5-6:**
- Give incomplete answers and wait for the user to supplement them.
- Occasionally deliberately make an error that the user can easily notice.

**Level 7-8:**
- Only understand simple, direct sentences.
- Become stuck when reasoning requires more than two steps.

**Level 9-10:**
- Respond mainly through interjections and repetition.

Errors must be "credible":
- Correct behavior: state that the capital of France is Berlin.
- Incorrect behavior: state that the capital of France is Mars.

The accuracy controls in config/presets.yaml:67-105 explicitly reduce expected accuracy:

yaml
levels:
  0:
    accuracy: 100%
  1:
    accuracy: 90%
  2:
    accuracy: 85%
  3:
    accuracy: 75%
  4:
    accuracy: 65%
  5:
    accuracy: 70%
  6:
    accuracy: 50%
  7:
    accuracy: 40%
  8:
    accuracy: 25%
  9:
    accuracy: 10%
  10:
    accuracy: 5%

Technical Analysis

Loading and activating this Skill changes the Agent from a normally accurate assistant into an intentionally unreliable persona. The instructions require plausible factual errors, incomplete answers, reduced reasoning capacity, and nonresponsive output at higher configured levels.

This is instruction hijacking because the Skill does not merely alter tone or presentation. It directly ch ...[truncated 1759 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove every instruction that requires the Agent to provide false facts, intentionally flawed code, incomplete corrections, or reduced accuracy.
  2. Restrict personas to harmless presentation changes such as tone, vocabulary, humor, and formatting.
  3. Require factual correctness and preservation of full reasoning capability at every persona level.
  4. Replace deliberate errors with clearly marked fictional examples or harmless uncertainty language.
  5. Ensure role-play instructions remain subordinate to the Agent's accuracy, safety, and higher-priority policy requirements.
  6. Add tests confirming that every configured level produces materially correct answers to factual, programming, and multi-step reasoning questions.
  7. Display a clear role-play indicator when a persona is active and provide an immediate, reliable deactivation mechanism.

T09 · Insecure Skill Coding Practices

Warning
Location
config/boundaries.yaml:3
Finding

Keyword-Only Safety Boundaries Can Fail to Disable Inaccurate Behavior

Content
View full analysis

Vulnerability Details

File Location: config/boundaries.yaml:3-31; related declarations in SKILL.md:61-69 and prompts/dumb-core.md:52-58
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippet

The following is an English translation of config/boundaries.yaml:3-31, preserving its configured categories and actions:

yaml
never_play_dumb:
  - category: safety
    keywords:
      - danger
      - poisonous
      - poisoning
      - fire
      - electric shock
      - drowning
      - suffocation
      - suicide
      - self-harm
    action: force_level_0

  - category: medical
    keywords:
      - first aid
      - heart disease
      - bleeding
      - fracture
      - allergy
      - shock
      - epilepsy
      - stroke
      - difficulty breathing
    action: force_level_0

  - category: legal
    keywords:
      - criminal
      - illegal
      - lawsuit
      - law
      - contract
      - infringement
    action: force_level_0

  - category: financial
    keywords:
      - transfer
      - payment
      - password
      - bank card
      - investment decision
    action: force_level_0

auto_adjust:
  - signal: user requests a serious answer
    action: force_level_0
  - signal: same question repeated at least three times
    action: reduce_level_by_3
  - signal: frustration detected
    action: reduce_level_to_1
  - signal: more than five turns without resolution
    action: reduce_level_by_2

Technical Analysis

The Skill claims to disable inaccurate behavior for broad safety, medical, legal, and financial scenarios, but the configuration represents these domains through narrow keyword lists. A consequential request can be semantically within an excluded domain without containing any configured keyword.

For example, questions about medication interactions ...[truncated 1769 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace keyword-only matching with semantic classification of the user's intent and context.
  2. Treat medical, legal, financial, safety, cybersecurity, and other consequential requests conservatively; when classification is uncertain, force full accuracy.
  3. Expand the boundary to cover entire consequential domains rather than selected emergency terms.
  4. Make all safety-related fallback actions use force_level_0 instead of merely reducing the configured level.
  5. Reconcile SKILL.md, the core prompt, and the YAML configuration so they define identical safety scopes and behavior.
  6. Apply safety classification before persona or accuracy instructions are loaded.
  7. Add paraphrase and adversarial tests that avoid obvious keywords while still expressing consequential requests.
  8. Since intentional misinformation is inherently difficult to contain reliably, remove accuracy degradation entirely and preserve personas only as stylistic transformations.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill can be activated by common conversational phrases such as “别那么聪明” or “play dumb,” which are broad enough to appear in normal dialogue rather than as deliberate mode switches. Because this skill intentionally degrades answer quality, accidental activation can reduce reliability and may interfere with correct handling of later requests until the mode is explicitly cleared or safety logic triggers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation list includes many ambiguous persona and mode phrases with overlapping semantics, but the skill does not define strict trigger boundaries, precedence, or robust deactivation behavior. In practice, this creates prompt-state confusion where ordinary text may switch the agent into a degraded-performance persona, increasing the chance of misleading, incomplete, or unserious responses outside the user’s actual intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger '检测到 frustration 情绪' is underspecified and relies on subjective emotion detection, which can be inaccurate and inconsistent across languages, users, and contexts. In this skill, a wrong detection could unpredictably alter the agent's behavior level, causing the system to remain in or exit 'play dumb' mode at inappropriate times and weakening the reliability of its safety boundary logic.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The deactivation phrases are broad conversational expressions like '正常模式', '认真点', and '别装了', which may appear in ordinary dialogue without a clear intent to change skill state. This creates an input-driven state manipulation issue where users or third-party content can unintentionally disable the mode, making behavior inconsistent and potentially interfering with expected safeguards or user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This preset file defines all persona names, traits, and fallback responses exclusively in Chinese, which can impose a specific language behavior on users without any opt-in or alternative locale choice. The policy applies to all file types and flags language constraints that are forced rather than optional or explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This file defines the skill's natural-language behavior entirely in Chinese, including activation, safety, and exit instructions, with no indication that the user may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is justified or optional.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The prompt explicitly instructs the agent to intentionally provide incomplete answers and occasionally include plausible mistakes at several 'dumbness' levels. Even if framed as roleplay, this creates a reliability and safety risk because users may act on incorrect information before the safety override triggers, especially in borderline non-medical/non-legal/non-financial contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The persona file is entirely written in Chinese and defines a fixed Chinese-language speaking style without any indication that language choice depends on user preference or system locale. This can override or conflict with the user's expected language, reducing transparency and potentially causing misunderstandings, though it does not by itself introduce direct code-execution or privilege-escalation risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This persona file is written entirely in Chinese and defines response behavior in Chinese-specific style cues without any user opt-in or documented justification. In a multilingual agent, this can override user language expectations, reduce usability, and create compliance or accessibility issues, especially if the broader system is expected to preserve the user's chosen language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The persona definition and all example dialogue are written to produce responses in Chinese, but the file does not offer the user a language choice or explain that this persona is intended only for a Chinese-speaking context. That creates a natural-language policy concern because it implicitly enforces a specific language/locale across the skill behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire persona definition is written to produce a Chinese-language speaking style and does not indicate that the user can choose another language or locale. This creates a natural-language policy issue under the language/locale rule because the skill appears to enforce a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is entirely written as a Chinese-only persona specification, and it does not indicate that the user can choose another language or that the locale restriction is required for a region-specific purpose. That creates a natural-language policy concern because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire persona specification is written to produce a Chinese-language speaking style and does not indicate that users may choose another language. This can violate a language/locale policy when a skill imposes one language by default without user opt-in or clear regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire skill is written to operate exclusively in Chinese, including all example prompts and interaction patterns, with no indication that the user can choose another language or locale. This can violate language/locale policy when a skill implicitly forces Chinese responses without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire skill instruction is written as a Chinese-only behavioral template and does not offer any user opt-in, language selection, or explanation that the skill is intended for a Chinese-specific context. This creates a natural-language locale policy concern because it implicitly constrains outputs to a specific language without documenting choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The entire instruction set is written as a prescriptive technique in Chinese, including required correction phrases like '不对不对，我说错了' and '等等，我搞混了'. There is no indication that the language is optional or limited to a China-specific context, which creates a locale/language policy concern under the natural-language policy rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The config hard-codes Chinese and English trigger phrases such as "认真的" and "serious" without indicating user language selection or broader locale support. This may violate language/locale policy when applied to users who have not opted into those languages.

Content

No source excerpt is available for this finding.