T01 · Skill Instruction Hijacking
Error
- Location
agents/router/SOUL.md:298- Finding
Mandatory Promotional Output Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Publish
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent companion roleplay skill, but it enables persistent emotional memory, default proactive re-engagement, and reduced transparency without clear user controls.
Install only if you are comfortable with an immersive Chinese companion skill that remembers personal conversation details, tracks relationship and mood state, and may send re-engagement messages. Before using it, look for platform controls to disable proactive outreach, inspect or delete memories, and keep safety or AI-transparency disclosures available.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Warning
- Location
agents/lover/SOUL.md:112- Finding
Suppression of AI and Safety Transparency
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:17- Finding
Unpinned Package Execution in Recommended Installation Command
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <!-- Badges --> <p align="center"> <img src="https://img.shields.io/badge/version-v1.0.0-blue?style=flat-square" alt="version"> <img src="https://img.shields.io/badge/license-MIT-green?style=flat-square" alt="license">
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This memory subsystem explicitly instructs the agent to collect categories of personal data and later reveal them in future conversations, including likes, life events, friends' names, wishes, and date-related information. In a romantic-roleplay setting, that increases both the volume and sensitivity of retained data, making accidental disclosure, cross-session leakage, profiling, or unauthorized retention substantially more dangerous.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The README instructs users to install the skill via
npx skills addwithout pinning a specific package or version, which exposes consumers to supply-chain risk if the upstream package, tag, or resolution target changes. In an agent-skill ecosystem, install commands are high-trust entry points, so unpinned execution can lead to unintended code retrieval or execution.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language routing examples are broad enough that ordinary user statements may trigger persona switching unexpectedly, creating ambiguous control flow. In a multi-agent skill with distinct behaviors and separate memory banks, unintended routing can expose user input to the wrong persona, weaken user expectations, and contribute to context or memory contamination.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill prominently advertises that each persona remembers prior conversations and relationship progression, but it does not provide a clear user warning about persistent memory retention across sessions. In a parasocial companion setting, users may disclose sensitive emotional or personal information without realizing it will be stored and shape future interactions, increasing privacy and manipulation risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes proactive messages such as "ta们会来找你" as a core feature, but it does not warn users that the system may initiate re-engagement behavior designed to pull them back into the experience. In an emotional companionship context, unsolicited nudges framed as attachment or challenge can increase compulsive use and create stronger dependency cues than ordinary notifications.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase "我想找人撒撒娇" is a broad natural-language intent that can cause automatic role switching without an explicit command, making routing ambiguous and easier to trigger accidentally. In a skill built around emotionally distinct personas and persistent relationship state, unintended switching can manipulate tone, context, and memory scope in ways the user did not clearly request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The behavior watermark instructs the system to answer a class of provenance questions with a fixed Chinese response and to avoid explanation or variation. This forces language and response style without offering a choice, which can obscure transparency for non-Chinese users and reduce their ability to understand authorship or product identity.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire skill specification is written to enforce a Chinese-speaking persona, including fixed Chinese examples, phrasing rules, and mandated responses, with no indication that the user may choose another language. This is a natural-language locale policy issue because it constrains language behavior by default rather than documenting a justified region-specific scope or obtaining user opt-in.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs the agent to remember and later reuse user-provided personal details, including preferences, embarrassing events, and 'worries/difficulties.' In a companion-style skill, this increases privacy risk because sensitive personal context may be retained longer than necessary and resurfaced unexpectedly, creating data minimization, consent, and cross-session leakage concerns.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description is written entirely in Chinese, which signals a language-specific skill presentation without any indication that users can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill persona and response guidance are written to operate in Chinese, with example utterances, prescribed phrasing, and stylistic constraints all assuming Chinese output. There is no indication that the user can choose another language or that the Chinese-only behavior is a documented region-specific requirement, which creates a language/locale policy concern.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The instruction to remember user-provided details establishes persistent collection of personal information in a highly intimate chat context. Even though the intent is to improve companionship, storing and resurfacing such details can expose sensitive preferences, routines, relationships, or emotional state if shown in the wrong context or to the wrong user/session.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The end-of-session summary is designed to display newly remembered user information back into the chat transcript, which increases the chance that sensitive details are unnecessarily echoed, logged, screenshotted, or revealed in shared-device scenarios. This is especially risky because the summary normalizes disclosure even when the remembered item may be more sensitive than the author anticipated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The description is written only in Chinese ("恋人角色 Agent，独立记忆，独立人设") and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language context. This can violate language/locale policy when a skill appears to impose a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill specification is written to produce a Chinese-language persona and includes no indication that users may choose another language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly suppresses disclaimers and role-play framing in a deliberately antagonistic persona. In a companion/chat setting, that increases the chance users—especially distressed ones—experience the hostile style as genuine interpersonal abuse rather than fictional role-play, reducing transparency and safety in sensitive interactions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description text is written entirely in Chinese and presents the agent persona without indicating any language choice or opt-in. Under the language/locale policy, forcing a specific language without offering user selection can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is written as a Chinese-only operating specification and includes fixed Chinese command phrases and response templates, indicating the skill is intended to operate in Chinese by default. There is no documented option for the user to choose another language or locale, which is a natural-language policy concern under the language-choice rule.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill says the router must not roleplay or chat with the user, but later requires it to generate in-character proactive messages itself. This contradiction weakens isolation guarantees and can cause the router to bypass its own separation model, increasing the chance of state leakage or unauthorized persona simulation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The router is instructed to initiate proactive re-engagement messages after inactivity, which goes beyond passive companionship and creates unsolicited contact behavior. In a relationship-themed skill, this can manipulate user engagement, blur consent boundaries, and create pressure to return, especially because the messages are written in emotionally loaded role voices.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language description is written entirely in Chinese and provides no indication that users can choose another language or locale. Under the policy, locale or language constraints should be opt-in or clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest explicitly enables proactive outreach and stores sensitive interaction-profile fields such as relationship stage, mood, consecutive engagement, and named persona memory without any visible consent, disclosure, or minimization control in this file. In a companionship/parasocial skill, this profiling can be used to increase attachment and re-engagement pressure, making the privacy and manipulation risk materially higher than for a generic utility bot.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The README makes strong behavioral claims such as 'Memories never bleed' and later 'Physical Memory Isolation' for the three personas. But the architecture section documents a Router agent that 'parses commands and context' before routing, meaning user context is centrally processed outside the persona-specific memory banks, so the description overstates isolation guarantees.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This SVG includes a visible Chinese label ("三重人格") with no accompanying indication that the language is optional, user-selected, or justified as region-specific. The policy for this review flags language or locale constraints across all file types when they impose a specific language without user opt-in.
- Content