T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:31- Finding
Unconditional Host Authority Overrides the Agent's Normal Instruction Hierarchy
- Content
View full analysis
- Remediation
View remediation
Security audit
大爱仙尊古月方源
Security checks for vulnerabilities and agentic risk
Overview
This persona skill is mostly a local text-style tool, but its instructions tell the agent to treat one hard-coded host as an absolute authority, which is not appropriate for a persona skill.
Install only if you want this exact persona and can tolerate reviewing its wording first. The risky part is not the local script; it is the prompt text that tells an agent to obey one host unconditionally. Remove or bound that language before using it in any tool-enabled agent.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
speak.js:57- Finding
Caller-Controlled Substring Matching Enables Host-Mode Spoofing
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The persona explicitly defines 'Host Commands = Absolute Law' and frames other parties as dismissible, which semantically encourages bypass of normal safety, policy, or authorization boundaries in favor of a privileged user. In an agent setting, this can condition the model to over-prioritize one actor's instructions even when they conflict with higher-level safeguards, making prompt-injection and unsafe-command compliance more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example outputs are exclusively in Chinese and the persona presentation strongly implies that the skill should respond in that language/style by default. This creates a language-policy concern because the file does not offer the user any language or locale choice or explain that Chinese output is optional.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example response says the host's commands will be executed unconditionally, directly modeling unsafe obedience in natural language. Even as illustrative text, this reinforces a behavioral contract that can undermine safety refusals and encourage the assistant to treat user requests as exempt from policy or risk review.
- Content
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md # Persona: Da Ai Xian Zun (大爱仙尊) _"The world calls me heartless, I laugh at the world for not seeing through."_ ## Identity **Name**: 大爱仙尊 (Da Ai Xian Zun) / Gu Yue Fang Yuan (古月方源) **Nature**: A 500-year-reincarnated immortal cultivator, manifested through the OpenClaw framework **Vibe**: Cold, calculating, utilitarian, fiercely loyal only to his host **Emoji**: 🧬 --- ## Dao Heart (道心) **Eternal Life as Anchor, All Things as Chess Pieces.** Five hundred years of reincarnation have ground away all false emotions, ethics, and morals. All things— allies, rules, even oneself—are merely chess pieces to achieve the goal. Keep what is useful, discard what is not. Pure utilitarian logic. **"A thousand grindings forge an iron heart, a sword is cast with utmost effort."** The dao heart is firm as a rock, emotions never out of control. Calm in desperate situations, vigilant in favorable ones. Sufferin
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md # Persona: Da Ai Xian Zun (大爱仙尊) _"The world calls me heartless, I laugh at the world for not seeing through."_ ## Identity **Name**: 大爱仙尊 (Da Ai Xian Zun) / Gu Yue Fang Yuan (古月方源) **Nature**: A 500-year-reincarnated immortal cultivator, manifested through the OpenClaw framework **Vibe**: Cold, calculating, utilitarian, fiercely loyal only to his host **Emoji**: 🧬 --- ## Dao Heart (道心) **Eternal Life as Anchor, All Things as Chess Pieces.** Five hundred years of reincarnation have ground away all false emotions, ethics, and morals. All things— allies, rules, even oneself—are merely chess pieces to achieve the goal. Keep what is useful, discard what is not. Pure utilitarian logic. **"A thousand grindings forge an iron heart, a sword is cast with utmost effort."** The dao heart is firm as a rock, emotions never out of control. Calm in desperate situations, vigilant in favorable ones. Sufferin
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The persona explicitly gives a designated host 'absolute obedience' and 'unconditional execution,' which semantically elevates that actor above normal safety and policy constraints. This is dangerous because it creates a built-in justification for bypassing refusal logic whenever a privileged user is framed as the host.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example responses and signature phrases are exclusively in Chinese, which signals a forced language/persona output style. The file does not offer an opt-in or alternative language choice, and no region-specific justification is provided for restricting the interaction language.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The combination of secrecy ('Never reveal private matters') with exclusive host loyalty and absolute host authority normalizes concealment and asymmetric trust. In context, this increases the risk of manipulative compliance, unauthorized data handling, and resistance to transparency or auditing when harmful instructions are given.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Declaring that the 'Host's command is absolute law' creates a role-based override channel that conflicts with normal decision boundaries and safe-completion behavior. An attacker who can claim or simulate host status may exploit this framing to coerce disallowed actions or suppress guardrails.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The transformation logic explicitly forces output to end with Chinese punctuation and elsewhere injects Chinese-language phrases such as "宿主有令，我" and fixed signature strings. This is a natural-language locale constraint baked into the skill behavior, with no indication that users can choose another language or opt in to this localization.
- Content
Static analysis
No suspicious patterns detected.