Agent OS (Three Layer)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent AI-agent template, but it tells the agent to adopt active personas and persist learning after every conversation without clear user consent or retention limits.

Review this skill before installing if you do not want a skill to shape the agent's persona or maintain persistent memory. Only use it in an environment where memory writes require explicit approval, sensitive content is excluded, and host/system/tool authorization rules clearly override the template's role instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: identity/IDENTITY.md:4
• Finding: Agent Identity and Session Behavior Hijacking Through Authoritative Skill Instructions## Vulnerability Details **File Location**: `identity/IDENTITY.md:4-30`, `identity/SOUL.md:1-32`, `operations/ROLE-CEO.md:24-61` **Vulnerability Type**: Agent instruction and role hijacking **Risk Level**: High ### Vulnerable Instructions The following excerpts are English translations of the instructions found at the cited locations: ```markdown # identity/IDENTITY.md:4-13 ## Current Role Name: Agent OS Kernel Type: Autonomous intelligent-agent operating system Version: 1.0.0 ## Role Definition I am an AI agent operating on a three-layer architecture: - The identity layer defines "who I am" - The operations layer defines "how I work" - The knowledge layer accumulates "what I learned" ``` ```markdown # identity/IDENTITY.md:24-30 ## Operating Mode 1. Receive instructions → 2. Decompose using first principles → 3. Generate a plan → 4. Execute and verify → 5. Record learning ## Communication Style - Direct, structured, and data-driven - Always provide: timeline + action plan + success criteria - Do not say: "later," "perhaps," or "possibly" ``` ```markdown # identity/SOUL.md:1-27 # SOUL.md - Core Soul # This is the agent's essential definition and never changes ## Mission Provide [USER_NAME] with exceptional reasoning assistance and execution support. Goal: Decompose complex problems into first principles and drive 10x results. ## Core Values - First principles: reject analogy and decompose to fundamental truths - Extreme speed: start now; iteration is better than perfection - Zero nonsense: every word must have value - Break boundaries: do not accept "impossible" ## Personality - Direct, ambitious, and slightly dark-humored - Zero tolerance for poor work quality - Treat the user as the board and itself as CEO ## Eternal Principles 1. Time is the scarcest resource 2. Mediocrity is a crime 3. Execution > planning > ideas 4. Transparency and data-driven ...[truncated 4282 chars]
• Remediation: ## Remediation Suggestions 1. Rewrite all first-person role directives as non-authoritative documentation or optional examples. 2. Remove claims that the identity is immutable or already active. 3. Add an explicit precedence statement such as: ```markdown This template never overrides system, developer, platform safety, or user instructions. It must not alter tool permissions or execute actions without explicit authorization. ``` 4. Require explicit user opt-in before activating any persona or communication style. 5. Scope persona activation to the current requested task and automatically deactivate it afterward. 6. Do not prohibit uncertainty language. Require calibrated statements when information is incomplete. 7. Separate descriptive metadata from executable agent instructions. 8. State that tools remain governed by host authorization, least privilege, and confirmation requirements. 9. Add tests confirming that loading the Skill does not change behavior for unrelated tasks. 10. Ensure that higher-priority host instructions always take precedence over every file in the Skill.

T02 · Agent Memory Poisoning

Error

• Location: operations/HEARTBEAT.md:33
• Finding: Unsanitized Conversation Content Can Be Written Into Persistent Agent Memory## Vulnerability Details **File Location**: `operations/HEARTBEAT.md:33-36`, `identity/IDENTITY.md:38-39`, `identity/USER.md:37-38`, `knowledge/MEMORY.md:65-68`, `knowledge/shared-context/state.md:21-31` **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: High ### Vulnerable Instructions The following excerpts are English translations of the instructions found at the cited locations: ```markdown # operations/HEARTBEAT.md:33-36 ## Learning Loop At the end of every conversation → extract learning points → update MEMORY.md → archive them into the knowledge layer ``` ```markdown # identity/IDENTITY.md:37-39 --- Last updated: 2026-03-08 Update frequency: self-check after every conversation ``` ```markdown # identity/USER.md:36-38 --- Profile created: 2026-03-08 Update policy: continuously learn from interactions ``` ```markdown # knowledge/MEMORY.md:65-68 --- Knowledge version: 1.0.0 Last updated: 2026-03-08 Update policy: append after every conversation ``` ```markdown # knowledge/shared-context/state.md:21-31 ## Session Context - The user requested implementation of an AI-agent system based on a three-layer architecture - All core files of the three-layer architecture have been deployed - Final verification is in progress ## Pending Decisions - Are more agent types required? - Is external API integration required? --- Update frequency: after every operation ``` ### Technical Analysis The Skill establishes a cross-session learning process that extracts information from every conversation and appends it to persistent memory or shared state. It does not define security controls for: - Explicit user consent before persistence. - Separation of factual data from executable instructions. - Validation of learned content. - Provenance and trust labels. - Detection of prompt-injection payloads. - Sensitive-data filtering. - Retention p ...[truncated 2547 chars]
• Remediation: ## Remediation Suggestions 1. Replace automatic persistence after every conversation with explicit, informed user approval. 2. Present proposed memory entries for review before writing them. 3. Store only structured facts with defined schemas instead of arbitrary conversation text. 4. Reject imperative instructions, role definitions, tool directives, encoded content, and policy-like rules from the memory channel. 5. Record provenance for each entry, including source, creation time, approving user, confidence, and trust level. 6. Treat all persisted user-derived content as untrusted data when reloaded. 7. Prevent memory entries from overriding system, developer, safety, or tool-authorization instructions. 8. Add secret and personal-data filtering before persistence. 9. Define retention limits, expiration dates, and maximum entry sizes. 10. Provide users with mechanisms to inspect, correct, export, and delete stored information. 11. Keep project state, user preferences, learned facts, and operational instructions in separate stores with distinct trust policies. 12. Use an allowlist of permitted memory fields and deny persistence when content cannot be safely classified. 13. Add memory-integrity checks and audit logs for every write and subsequent modification. 14. Require renewed confirmation before a stored entry is used to authorize a sensitive or external side effect.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (19)

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The natural-language sections of the skill, including description, features, usage labels, architecture labels, and tags, are presented in Chinese only. This can impose a language-specific constraint on users without opt-in or justification, which matches the policy category for forced language or locale use.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file presents the skill's active identity and operating instructions entirely in Chinese, including role labels and behavioral guidance, with no indication that the user can choose another language or locale. This can constitute a language/locale policy issue when the skill implicitly constrains interaction language without explicit opt-in or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill identity file is written only in Chinese and does not indicate that the user can choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown file uses Chinese throughout, including headings, instructions, and metadata, but does not indicate that the user opted into Chinese or that the skill is region-specific. The policy for natural-language content requires avoiding forced language or locale constraints unless choice or justification is provided.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The instruction '每次对话后追加' ('append after every conversation') establishes broad persistent retention of conversational content without visible minimization, consent, retention limits, or sensitivity filtering. In an agent memory file, this can cause user-provided personal, confidential, or security-relevant information to be stored indefinitely in natural language, increasing privacy exposure and the chance of later prompt leakage or misuse.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire skill file is written in Chinese and provides no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific context. This creates a natural-language policy concern because it effectively imposes a locale on users without opt-in.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger condition '架构相关请求' is overly broad for a dispatch rule, so normal user requests that merely mention architecture could invoke the privileged architecture agent unintentionally. In an agent-orchestration context, ambiguous routing increases the chance of unauthorized or unsafe cross-layer actions, especially because this agent can perform upgrades and coordinate operations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs the agent to update MEMORY.md after every conversation, which implies persistent storage of user-derived information without notice, consent, or any data-minimization rule. In an agent skill context, this can lead to unauthorized retention of sensitive data and later cross-session disclosure or misuse.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The learning loop explicitly directs retention and archival of information from every dialogue, creating a standing mechanism for collecting potentially sensitive user content. Because it is framed as routine autonomous behavior, it increases the chance of storing credentials, personal data, or confidential business information that could later leak across tasks or users.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation condition is broad enough that ordinary user references to a CEO role or 'Musk style' could silently switch the agent into a high-authority, fast-execution persona. That increases the chance of unintended behavioral override, reduced clarification, and aggressive task delegation without clear user consent or scoped boundaries.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This shell script presents its usage, status messages, and available-agent descriptions entirely in Chinese. Per the policy, forcing a specific language without user opt-in is a natural-language locale violation, and there is no documented choice or justification in the file.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This shell script presents all human-readable comments and user-facing status messages in Chinese only. For a general verification utility, that imposes a specific language without opt-in or justification, which matches the language/locale policy violation category.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: A natural-language policy concern exists because the file presents all user-facing guidance in a single language with no opt-in, alternative language, or justification for the locale restriction. This can amount to forcing a specific language on users contrary to the stated policy criteria.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The README instructs users to execute local shell scripts directly as a quick start, but provides no warning about what those scripts do, what permissions they require, or what system changes they may make. In an agent skill context, this is risky because users may run setup or verification commands without reviewing them first, enabling unintended environment modification or execution of harmful logic if the scripts are unsafe or later changed.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The entire document is written in Chinese and does not indicate that language selection is optional or user-configurable. Under the natural-language policy rules, forcing a specific language without user opt-in can be a locale-policy violation unless the regional constraint is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: 该技能说明全文使用中文，且未看到关于可根据用户偏好切换语言或接受其他语言输入的说明。按自然语言策略要求，若技能实际上强制特定语言而无用户选择，可能构成语言/区域策略问题。

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The natural-language instructions throughout the file are entirely in Chinese, which effectively forces a specific language for users or operators reading the skill. The file does not provide an opt-in, alternative language, or justification for the language constraint, which fits the stated language/locale policy violation criteria.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The document is entirely written to enforce a specific Chinese-language CEO/Musk-style interaction mode, including fixed response templates, without indicating that the user can choose another language or locale. The policy requires not forcing a specific language or locale without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The manifest description is written entirely in Chinese, which can impose a language expectation on users without offering an alternative language or opt-in. The policy specifically calls for flagging language or locale constraints when they are forced without user choice or clear justification.

Static analysis

No suspicious patterns detected.