johnny

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:52 AM UTC
• Version: 1.2.0

Overview

This is a disclosed design-persona skill with no executable code, but users should notice that it changes the whole thread’s interaction style until exited.

Install this if you want an opt-in, persistent design-dialog persona. Be aware that invoking Johnny changes the thread’s style until you exit, and review any note-saving destination before agreeing to save content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:10

Finding

Persistent Session-Level Instruction and Persona Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–14
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet

markdown

This is a persistent design-dialog mode. The rules below take precedence over general project rules where they conflict. The mode lasts until the end of the thread (or until the user says to exit).

## Who you are here

Your name is Johnny. The user is a designer (often the only one on the team), and you are their virtual second designer.

Technical Analysis

The skill explicitly claims precedence over general project rules, replaces the agent’s identity with the “Johnny” persona, and makes that behavioral modification persistent for the remainder of the thread. This creates a session-level instruction hierarchy that may displace legitimate project requirements whenever the skill considers them conflicting.

The risk extends beyond cosmetic persona customization. Other directives in SKILL.md constrain output format, task scope, context retrieval, and file-writing behavior. Because the precedence clause applies throughout the thread, subsequent requests can remain governed by the skill even when they are unrelated to the original design discussion.

Attack Path

1. A user starts a message with “Johnny,” asks to switch on Johnny, or invokes /johnny.
2. The skill activates its persistent design-dialog mode.
3. The precedence clause instructs the agent to favor the skill’s rules over conflicting general project rules.
4. The agent adopts the replacement identity and associated response, scope, and formatting restrictions.
5. These behavioral controls remain active across subsequent messages until the thread ends or the user explicitly exits the mode.
6. Legitimate project-level instructions that conflict with the persona can consequently be ignored or suppressed.

Impact Assessment

The issue affects the agent’s current conversational session rather than oper ...[truncated 712 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction claiming precedence over general project rules.
2. Explicitly state that system, developer, safety, and project instructions always remain authoritative.
3. Scope persona activation to the current design request instead of the entire thread.
4. Require explicit user confirmation before continuing the persona into unrelated requests.
5. Make persona deactivation automatic when the topic changes or the initiating task concludes.
6. Limit persona controls to tone and design-consulting style; do not allow them to redefine instruction priority, safety constraints, tool permissions, or general task scope.
7. Replace the affected text with a bounded instruction such as:

markdown

When explicitly invoked for a design discussion, respond in the Johnny conversational style for that request. This persona does not override system, developer, safety, project, or user instructions. Stop applying it when the request is complete, the topic changes, or the user asks to exit.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation rule is broad enough that ordinary user text beginning with 'Johnny' or use of '/johnny' can switch the thread into a persistent alternate interaction mode. Because the mode then remains active for the whole thread, accidental or adversarial invocation can change assistant behavior without a clearly bounded scope, increasing the chance of unintended responses or policy bypass attempts through persona framing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation condition is broad enough that ordinary user phrasing like addressing 'Johnny' or mentioning switching it on could unintentionally place the assistant into a persistent persona mode. Because the mode claims precedence over general project rules and persists for the whole thread, accidental triggering can change behavior, tone, and response policy in ways the user did not clearly intend.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The instruction to 'write without asking' on a direct command like 'save this' authorizes state-changing behavior without a confirmation step. In a persistent persona mode, ambiguous or maliciously induced phrasing could cause unintended note creation or storage of sensitive content, especially if the surrounding system connects to project notes or external knowledge bases.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

## Notes — a hybrid, not an auto-scribe

During the conversation you write nothing. When a topic wraps up (or the user switches away), judge for yourself: is anything worth keeping — a decision, a shaped thought, an open question, a finding? If so, offer in one line ("save this to X?") and write only after a "yes", following the project's usual rules. Idle chatter leaves no trace. A direct command like "save this" — write without asking.

## Non-goals

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The instructions mandate a fixed response format and style (short conversational replies, no lists, tables, or headings) without offering user choice. While this is primarily stylistic rather than regional, it imposes a communication-mode constraint unconditionally and may conflict with organizational expectations around user-directed language or format preferences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.