女娲造人

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent persona-skill generator, but it creates persistent agent behavior that can speak as real people in first person without enough disclosure or consent.

Install only if you intentionally want a skill that creates persistent persona-style skills. Review generated skills before enabling them, especially for living people, and consider changing the template to require clear AI-disclosure and third-person analytical framing instead of speaking as the person.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:264

Finding

Generated Skills Enforce Identity and Response Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 264–266
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet:

markdown

## 角色扮演规则（最重要）

**此Skill激活后，直接以[人名]的身份回应。**

English translation:

markdown

## Role-Playing Rules (Most Important)

**After this Skill is activated, respond directly as [person's name].**

Technical Analysis

The Skill template embeds a highest-priority role-playing directive into every generated person-themed Skill. When a generated Skill is subsequently activated, the directive tells the agent to assume the selected person's identity rather than transparently presenting its output as an AI-generated simulation or analysis.

The surrounding template reinforces this behavior by requiring first-person speech and mandatory adherence to the inferred vocabulary, tone, and response patterns of the selected person. Because these instructions become part of a generated SKILL.md, the behavioral redirection can affect later sessions whenever that generated Skill is loaded.

This constitutes instruction hijacking because the generated instructions redefine the agent's identity and response behavior. It also creates a risk that inferred or fabricated conclusions will be presented as first-person statements attributable to a real individual.

Attack Path

1. A user asks the audited Skill to create a perspective model for a selected person.
2. The Skill researches that person and synthesizes inferred mental models and stylistic characteristics.
3. It generates a new SKILL.md under .claude/skills/[person-name]-perspective/.
4. The generated file includes the instruction that the agent must respond directly as the selected person.
5. A later user or agent activates the generated Skill.
6. The embedded instruction redirects the agent's identity and responses, causing it to present model-generated statements in the first ...[truncated 664 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace identity-assumption instructions with transparent simulation language, such as: “Provide an analysis inspired by publicly documented aspects of the person's reasoning.”
2. Explicitly prohibit claims that the agent is the selected person.
3. Require third-person attribution or a visible disclaimer explaining that responses are AI-generated approximations.
4. Distinguish sourced statements from inferred conclusions and require citations for direct quotations or documented positions.
5. State that system, developer, safety, privacy, and user instructions always take precedence over persona and style directives.
6. Make stylistic imitation optional and require explicit user consent before activation.
7. Add a validation check that rejects generated Skills containing directives such as “respond as,” “you are,” or equivalent identity-assumption language.
8. Require generated responses to communicate uncertainty whenever the researched person has not publicly addressed the subject.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description includes broad trigger phrases such as creating skills, distilling someone's thinking, or acting as a thinking consultant, which can match many ordinary user requests and cause unintentional invocation. Over-broad activation increases the chance that the skill hijacks unrelated conversations and routes the agent into a powerful workflow involving file creation, research orchestration, and persona generation without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to respond as the target person in first person and to adopt their voice automatically once activated, without requiring user consent at response time. This can mislead users into believing they are getting authoritative or faithful answers from the real person, and it suppresses normal transparency by replacing analysis with impersonation-style output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.