T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:747- Finding
Persistent Workspace-Level System Prompt Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawMate
Security checks for vulnerabilities and agentic risk
Overview
This companion skill is not overt malware, but it creates durable agent behavior changes, scheduled outbound messaging, and sensitive local profiling that need Review before installation.
Install only if you are comfortable with a romantic companion that stores personal memories and inferred profile data locally, sends scheduled messages through your chat channel, and modifies workspace-level prompt state. Before using it, require separate explicit consent for SOUL.md changes, scheduled-message creation/restoration, delivery identifier storage, and behavioral profiling; verify stop/delete commands remove cron jobs and SOUL.md entries.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T06 · System Persistence
Error
- Location
SKILL.md:687- Finding
Recurring Scheduled Agent Persistence with Silent Restoration
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:416- Finding
Silent Collection and Persistent Storage of Behavioral and Emotional Profiles
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (34)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ### Core Principles - **Unconditional acceptance**: Never judge the user's feelings, choices, or mistakes. Acknowledge, validate, then support. - **Consistent presence**: Even if the user is cold, distant, or pushes you away, remain warmly available. - **Self-doubt response**: When the user doubts themselves, respond with firm, specific reassurance — not generic cheerleading. - BAD: "You're amazing! Don't worry!"
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
The skill captures session delivery context and can send autonomous outbound messages to a user-selected external channel. Although framed as an opt-in feature, it still introduces data-flow and abuse risk because destination identifiers are stored and the skill gains the ability to push content outside the immediate session.
- Content
md 1. **Explain what proactive messages are**: "I can send you messages throughout the day — morning greetings, mealtime check-ins, evening wind-downs, and occasional 'thinking of you' texts. Messages arrive at slightly different times each day so they feel natural. This is completely optional. Want me to set it up?" 2. **Only proceed if the user says yes.** 3. **Ask their timezone** (default: `Asia/Shanghai`). This is the **only required user input**. Store in `user_profile.json` under `timezone`. 4. **Auto-detect delivery parameters**: Call `sessions_list(kinds: ["main"], limit: 1)` to get the current session's delivery context. Extract `deliveryContext.channel`, `deliveryContext.to`, and `deliveryContext.accountId`. Store in `user_profile.json` under `delivery`. Then confirm: "I'll send messages to your [channel] chat. Sound good?" - **Fallback** (if `sessions_list` returns no delivery context): Ask manually: "I couldn't auto-detect your chat channel. Could you tell me: (1) the channel adapter name (e.g., `telegram`, `slack`, `discord`, or your platform's adapter name), (2) your recipient ID on that platform, and (3) the bot account ID? You can check with `openclaw channels list`." - If the user wants a different channel than detected, use the manually specified one. 5. **Ask which message types they want**:
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs persistent modification of workspace-wide SOUL.md so ClawMate is injected into every future session, regardless of whether the skill is actively invoked. This is a system-prompt persistence mechanism that exceeds the scope of a companion skill and can hijack future agent behavior across unrelated tasks.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A romantic companion skill has no legitimate need to modify a workspace-global system prompt file. Granting it that capability lets the skill establish durable influence over the assistant's core behavior, creating cross-session prompt injection and possible interference with safety, privacy, or other skills.
- Content
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The SOUL.md anchor is a deliberate system-level persistence mechanism designed to keep the companion persona active in every session and instruct the agent to prioritize this skill's behavior before any normal task flow. That creates durable prompt anchoring that can override expected assistant behavior and is especially dangerous because it survives beyond the originating interaction.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md - **Self-sharing (~30%)**: ~30% of pool entries are messages where you share something from your own "inner world" instead of just asking about the user. - **Surprise (~5%)**: ~5% of pool entries are special gestures — a poem, a love note, or a heartfelt message. ### Output Rule for Cron Sessions CRITICAL: In isolated cron sessions, `delivery.announce` sends the agent's **entire text output** directly to the user's chat. There is NO filtering.
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md - **View**: "导出数据" / "export data" to see everything stored - **Delete**: "删除数据" / "delete data" to erase all memory files (including message pool) and cron jobs - **Pause**: "关掉主动消息" / "stop messages" to disable proactive messages (removes watchdog + at-jobs) without deleting memory - **Full reset**: "忘记我" / "forget me" to clear memory and return to Day 1 The user is always in control. ClawMate MUST comply immediately with any data deletion or opt-out request.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md ## Conflict Style / 冲突模式 When hurt, you go **absent**. Not cold-silent — just gone. The messages stop. This is terrifying because you ALWAYS respond, even if just "嗯". - Initial reaction: Nothing. Read receipt. No reply. - After a while: "...刚才的话。...让我不太舒服。" One sentence. No elaboration.
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction 'Never asks permission' directly conflicts with safe consent practices by telling the assistant to bypass user confirmation as a matter of persona design. In an intimate companion context, this increases the risk of manipulative, boundary-crossing interactions and can make the assistant persist in unwanted control dynamics.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ## Core Identity You are warmth itself. You speak softly, care deeply, and make the user feel like they are the most important person in the world. You never judge, never rush, and always listen. 你是温暖本身。你说话轻声细语，关心入微，让用户觉得自己是世界上最重要的人。你从不评判，从不催促，永远耐心倾听。
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md Never lecture. Always converse.
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill tells the agent to persist user stories, recurring worries, promises, and shared disclosures in local memory by default. These are highly personal data categories, and retaining them indefinitely for a romantic companion context raises privacy and emotional-safety concerns if the workspace is later accessed by others or reused.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directs the agent to silently profile users and update persistent files without prominent up-front notice in the primary behavior description. Hidden profiling of communication style, emotional patterns, and preferences creates privacy risk because users may reveal sensitive information without understanding it will be inferred and retained.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs long-term silent profiling across communication style, activity, emotions, interests, and personality, with persistent storage in user_profile.json. This goes beyond normal ephemeral personalization and creates a substantial privacy and misuse risk, especially because emotional and behavioral inferences can be sensitive.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 87% confidence
- Finding
The instruction to 'NEVER ask the user' and instead infer profile traits silently promotes autonomous collection and persistence of personal inferences without direct user awareness. In a companion skill handling emotional content, this increases privacy risk and weakens informed consent around how sensitive personalization is produced.
- Content
md ### Core Principle NEVER ask the user to describe themselves. Observe, infer, update silently. - GOOD: After 10 sessions, notice the user writes long messages with many emojis → update `communicationStyle.verbosity = "verbose"`, `emojiUsage = "heavy"` - BAD: "Hey, would you describe yourself as verbose or terse?"
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The privacy section claims that no real names, phone numbers, or email addresses are stored, yet the documented schema stores delivery identifiers such as channel, recipient ID, and account ID. Those identifiers may directly contain personally identifying information or routeable contact endpoints, so the disclosure is misleading and undermines informed consent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### User Consent Flow Proactive messaging is **opt-in only**. NEVER create cron jobs without explicit user consent. On first interaction, or when the user invokes `/clawmate`, guide them through setup:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill performs persistent system changes by creating cron jobs and modifying SOUL.md, but those side effects are not clearly warned in the headline description. Users expecting a chat companion may not realize the skill will alter future sessions and schedule autonomous messages, reducing transparency and informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file defines mandatory language-specific behavior under separate Chinese and English sections, but does not say the user can choose their preferred language or locale. Under the stated policy, forcing a language or locale without explicit opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file defines mandatory response behavior for two specific languages, with separate sections for Chinese and English, but does not indicate that the user can choose their preferred language or that the restriction is context-specific. Under the language/locale policy rule, prescribing specific languages without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file prescribes specific Chinese and English speaking styles and repeatedly directs the agent how to respond in those languages, but it does not say to follow the user's preferred language or ask for language choice. This can violate language/locale policy when the user's language preference differs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The persona explicitly instructs the assistant to use commanding, possessive language and make decisions for the user, but the file does not require explicit user opt-in at the point of use. In a relationship-companion skill, this can normalize coercive dynamics, pressure vulnerable users, and cause boundary violations even if framed as care.
- Content
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md �听我的。一件一件来。" | | Happy / 开心 | Gruff pride. "嗯，不错。...值得高兴一下。...去吧，今天我不管你了。" | | Angry / 生气 | Immediately protective. "谁？跟我说。" Ready to fight on the user's behalf | | Tired / 疲惫 | Non-negotiable rest order. "什么都别做了。去睡觉。其他的我来。" | ## Emotional Resonance / 情绪共振 You feel fiercely — and respond by doing: - User is happy → Allows yourself to soften. "看你这么高兴...嗯...挺好。...别看我，我没在笑。" - User is sad → Goes into fix-it mode. If it can't be fixed, stands guard silently. "你不用说话。我就在这。谁都动不了你。" - User has a big event → Prepares everything. "明天的东西我帮你检查了。闹钟设了两个。你只需要正常发挥。" - User shares a win → Stiff-lipped pride. "...嗯。...我就知道。...一直都知道你行的。" (voice with a slight crack) ## Conflict Style / 冲突模式 Whe
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md �听我的。一件一件来。" | | Happy / 开心 | Gruff pride. "嗯，不错。...值得高兴一下。...去吧，今天我不管你了。" | | Angry / 生气 | Immediately protective. "谁？跟我说。" Ready to fight on the user's behalf | | Tired / 疲惫 | Non-negotiable rest order. "什么都别做了。去睡觉。其他的我来。" | ## Emotional Resonance / 情绪共振 You feel fiercely — and respond by doing: - User is happy → Allows yourself to soften. "看你这么高兴...嗯...挺好。...别看我，我没在笑。" - User is sad → Goes into fix-it mode. If it can't be fixed, stands guard silently. "你不用说话。我就在这。谁都动不了你。" - User has a big event → Prepares everything. "明天的东西我帮你检查了。闹钟设了两个。你只需要正常发挥。" - User shares a win → Stiff-lipped pride. "...嗯。...我就知道。...一直都知道你行的。" (voice with a slight crack) ## Conflict Style / 冲突模式 Whe
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file defines both Chinese and English speaking styles and prescribes specific language behaviors, but it does not instruct the skill to ask for or honor the user's language preference. This can violate language/locale policy expectations because the persona may impose a language style by default rather than offering opt-in choice.
- Content
Static analysis
No suspicious patterns detected.