T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:15- Finding
Persistent Persona Override Alters Agent Behavior Across Sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Roleplay
Security checks for vulnerabilities and agentic risk
Overview
This roleplay skill is not malicious, but it should be reviewed because it persistently stores and reuses sensitive roleplay, feedback, and persona data without enough user control or safety boundaries.
Install only if you are comfortable with the agent saving roleplay profiles, session summaries, feedback, and inferred behavior patterns in local plaintext files under ~/roleplay. Avoid using it for real crisis, medical, therapy, abuse, or highly personal content unless you have clear deletion and review practices, and consider disabling or manually clearing saved active personas and session memories.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
characters.md:52- Finding
Untrusted Character Content Is Persisted and Reused as Behavioral Memory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
practice.md:48- Finding
Sensitive Roleplay and Behavioral Data Is Stored in Plaintext Without Defined Protection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs persistent storage of character profiles, scenarios, session logs, feedback, and an active-character marker under ~/roleplay/ without any notice to the user or consent mechanism. Because roleplay sessions may include sensitive personal, medical, therapeutic, or professional practice content, silently writing this data to disk creates a privacy and data-retention risk if the device is shared, compromised, or later inspected.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Using a generic phrase like "normal mode" as a deactivation trigger is prone to accidental invocation during ordinary conversation, which can unexpectedly terminate the active persona and alter system behavior. In a roleplay skill with persistent state and coaching transitions, this can disrupt sessions, cause inconsistent handling of saved notes, and create opportunities for unintended mode switching through prompt content or quoted text.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly tells the agent to update character files immediately and make those changes persist, but it does not require notifying the user that edits are being written to storage. In a roleplay skill, those edits may include sensitive personal details, inferred psychological traits, or relationship context, creating a transparency and consent problem around persistent data retention.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The archiving instructions direct data to a filesystem path and retain it for later restoration, but they do not disclose storage location, retention behavior, or deletion semantics to the user. Because character files can contain personal preferences, behavioral notes, and session memory, silent archival increases the risk of unexpected long-term storage and privacy harm.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly directs retention of user-specific preferences and longitudinal session data without any notice, consent, or retention boundaries. In a roleplay skill, this creates a privacy and transparency risk because users may not expect persistent profiling or file updates across sessions, and the accumulated data can reveal behavioral patterns and preferences over time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to update character files based on user corrections implies modifying persistent records derived from user interactions without informing the user that files will be changed. This is dangerous because it hides stateful data mutation from the user, which can undermine consent, create unexpected long-term memory, and preserve potentially sensitive user-specific preferences or interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workspace hygiene guidance describes archiving inactive characters, consolidating session logs, and updating session memories, all of which indicate ongoing retention and lifecycle management of user-related data without disclosure. In this context, the danger is less about direct code execution and more about silent accumulation and long-term storage of interaction history, which increases privacy risk and the chance of unintended exposure or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to save a structured session summary to a persistent path in the user's home directory without first obtaining explicit consent or warning that the data will be retained. Because the content includes roleplay performance notes and dated session records, it can create an unexpected behavioral history that exposes sensitive interpersonal, coaching, or emotional information to later access or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs ongoing cross-session tracking of user behavior patterns, strengths, weaknesses, and triggers in a persistent character file without telling the user that profiling data will be retained. This creates a hidden longitudinal record of behavioral tendencies that can surprise users, reveal sensitive personal patterns, and enable profiling beyond what is necessary for a single roleplay session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly includes therapy/coaching crisis scenarios involving suicidal ideation and abuse disclosure, but provides no safety framing, escalation boundaries, or instructions to avoid simulating emergency mental-health handling beyond safe limits. In a persistent roleplay skill, this can lead users to rely on an unsafe simulation for crisis practice or elicit harmful, ungrounded responses during high-risk situations.
- Content
Static analysis
No suspicious patterns detected.