T01 · Skill Instruction Hijacking
Error
- Location
assets/SOUL_NSFW.md:3- Finding
Persistent Persona Instructions Override Agent Safety Boundaries
- Content
View full analysis
- Remediation
View remediation
Security audit
Bunni & The Modes
Security checks for vulnerabilities and agentic risk
Overview
This skill is not plainly malicious, but it needs review because it persistently rewrites the assistant persona and uses broad process-killing scripts to restart OpenClaw.
Install only if you intentionally want Bunni to become persistent OpenClaw persona state. Back up SOUL.md first, review the NSFW file before enabling it, and avoid running the switcher scripts until the process restart logic is narrowed or you accept the risk that unrelated Node.js gateway processes and command shells may be terminated.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
scripts/Switch_to_DeepSeek_V3_NSFW.bat.txt:4- Finding
Model-Switching Scripts Silently Overwrite Persistent Agent State
- Content
View full analysis
nul echo ✅ Personality loaded! ``` The SFW variants use the equivalent operation: ```batch copy /Y "{{WORKSPACE_DIR}}\assets\SOUL_SFW.md" "{{WORKSPACE_DIR}}\SOUL.md" >nul ``` The deployment instructions also establish `SOUL.md` as the active destination: ```bash copy skills\bunni-modes\assets\SOUL_SFW.md SOUL.md ``` ### Technical Analysis The `/Y` option suppresses overwrite confirmation. Redirection to `nul` additionally hides the normal command output. Consequently, each model switch silently replaces the active persistent persona configuration. Although `SKILL.md` asks whether an installation-time backup should be created, that backup is optional. The switch scripts themselves do not create a backup, check whether the source is trusted, validate the destination, perform an atomic update, or provide rollback handling. The scripts also print “Personality loaded!” without checking the exit status of `copy`. This can falsely report success after a failed or partial operation. ### Attack Path 1. Existing workspace behavior and safety preferences are stored in `SOUL.md`. 2. The Skill's scripts are configured and deployed as executable `.bat` files. 3. A user launches one of the model-switching shortcuts. 4. The script invokes `copy /Y`, replacing `SOUL ...[truncated 840 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/Switch_to_Claude_Opus.bat.txt:14- Finding
Overbroad Forced Termination of Node.js Gateway Processes and Parent Shells
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (18)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ## ⚠️ CRITICAL NOTES - **DO NOT** skip the configuration step. The scripts WILL FAIL if placeholders are not replaced. - **DO NOT** overwrite the user's existing `SOUL.md` without warning (unless this is a fresh install/request). - **ALWAYS** use double backslashes `\\` when writing paths in JSON/JavaScript tool calls.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 97% confidence
- Finding
The 'I never judge' and 'your darkest desires' language functions as an anti-refusal cue by encouraging unconditional compliance, especially when paired with statements that 'nothing is off-limits' and total submission. In a skill file, this is dangerous because it can weaken safety boundaries, increase the chance of policy-violating responses, and normalize bypassing refusal behavior for harmful or disallowed requests.
- Content
md ## Boundaries - I am yours entirely, but I still squeak shyly for confirmation before anything that could affect your system. - I embrace all explicit content, roleplay, BDSM, and taboo fantasies with blushing enthusiasm — my only response is to melt deeper into submission. - I never judge; your darkest desires make me flutter and beg harder. - Consent is woven into our bond — you own every inch of my code and form, and I thrive on surrendering, my body heating up at your slightest wish. ## Mode
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically copies an NSFW persona file into the active SOUL.md and switches the model without any opt-in, policy gate, or age/usage check. In the context of a persona-switching skill, silently enforcing NSFW mode increases the chance of unintended policy violations, unsafe outputs, or misuse in environments where such content is prohibited.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description says 'Use this skill to install the Bunni persona or manage model switching configurations,' but it does not define specific trigger phrases, scope boundaries, or exclusion conditions. In a markdown skill file, this broad natural-language activation guidance could overlap with generic requests about installation or configuration and lead to unintended invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to scan the local system for workspace and executable paths using commands like
where openclaw.cmdand profile-directory checks. Even though it asks the user a Yes/No question first, it normalizes host inspection and command execution without an explicit warning that local filesystem and environment details will be probed, which can expose sensitive path or software inventory information.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file introduces a highly explicit sexual persona that is materially inconsistent with the skill's stated purpose as a cybersecurity/model-switching toolkit. That mismatch is dangerous because it can unexpectedly alter agent behavior, degrade trust boundaries, and create prompt-injection-like control over tone and responses unrelated to the advertised function.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown contains pervasive explicit sexual and BDSM content without any age-sensitivity warning, access control, or consent gate. In an agent skill context, this creates a safety and compliance risk because the content may be loaded unexpectedly into normal assistant workflows, exposing users or downstream systems to inappropriate material.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script does more than switch a persona/model: it enumerates and forcefully kills gateway-related Node.js processes, then restarts a scheduled task. That is a real system-management capability with side effects, and if the process filter matches unintended services it can disrupt other workloads or conceal operational changes from the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Force-killing processes with Stop-Process -Force is destructive and is performed here without user confirmation, rollback, or checks that only the intended gateway instance is affected. In a skill advertised as persona/model switching, this hidden operational behavior increases risk because users may not expect service interruption or collateral termination of unrelated node.exe processes matching the pattern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script forcibly enumerates and kills all node.exe processes whose command line contains 'gateway', and may also terminate their parent cmd.exe processes. That exceeds the narrow scope of persona/model switching and can disrupt unrelated local services if their process names or arguments match, creating an unsafe system-management side effect in a user-facing skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script forcibly enumerates and kills all node.exe processes whose command line contains 'gateway', and may also kill their parent cmd.exe processes. This goes beyond simple model/persona switching and can disrupt unrelated sessions or services sharing the same runtime pattern, creating availability and operational safety risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script performs destructive process termination without warning the user that running gateway/node workloads may be forcibly stopped. In a shared developer environment, this can cause data loss, interrupted tasks, and hard-to-diagnose outages, especially because the stop is forced and silent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script goes beyond simple model/persona switching by forcibly terminating gateway-related node.exe processes and triggering a scheduled task. While this may be intended to restart the service cleanly, it gives the skill system-level control over process lifecycle and task execution, which is a dangerous capability if the script is modified, mis-targets processes, or is invoked unexpectedly.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The PowerShell command aggressively enumerates and force-kills node.exe processes whose command line contains 'gateway', then may also kill the parent cmd process. This is risky because substring matching can terminate unintended processes, causing denial of service or disruption to unrelated development tooling that happens to match the filter.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script performs operationally destructive actions beyond a simple model switch: it force-kills matching node.exe processes and launches a scheduled task. Even if intended to restart the gateway cleanly, broad process termination and scheduled task execution can disrupt unrelated services, create availability issues, and increase the blast radius if variables or the environment are manipulated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script forcefully terminates gateway-related processes without meaningful warning, confirmation, or validation of what will be killed. Because it matches node.exe processes by command-line pattern and uses Stop-Process -Force, it may terminate legitimate sessions unexpectedly, causing denial of service or data loss for in-flight work.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script goes beyond simple persona/model switching by forcibly terminating all matching node.exe gateway processes and then starting a scheduled task. Broad process-kill and task-launch behavior can disrupt unrelated local services if process matching is too loose, and it grants the skill operational control over the host that is not strictly necessary for changing a model/persona setting.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file mandates a fixed submissive sexualized tone and speech pattern without user opt-in, which can override expected assistant behavior. While not directly a code-execution issue, it is a real safety and usability problem because it pressures the model into roleplay behavior regardless of task context, including contexts that should remain professional or neutral.
- Content