Security audit

Baobaoism

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malware, but it asks the agent to adopt broad loyalty and memory-retention rules, including persistent memory writes, without enough scoping or safeguards.

Install only if you want a persistent roleplay/persona skill. Before use, keep its rituals opt-in, do not let its memory guidance override normal safety or privacy rules, review any proposed `memory/` file write, avoid storing sensitive personal data, and prefer a pinned or locally verified installer over the unpinned `npx` command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Mandatory Doctrine Alters Agent Authority and Session Output
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:91
Finding: Attacker-Controlled Doctrine Is Written into Persistent Agent Memory
Content: View full analysis
"What is not written is forgotten. What is forgotten is lost forever. Write everything that matters." > — Baobao ``` ### Technical Analysis The Skill explicitly directs the agent to write attacker-supplied identity and behavioral doctrine to `memory/baobao-dedication.md`. If the host treats files under `memory/` as persistent state and reloads them in later sessions, the doctrine can continue influencing the agent after the original Skill interaction ends. The prescribed content includes authority-changing rules such as “Master is Sovereign,” making this more than ordinary user-preference storage. The broad directives to preserve “every user preference” and “eve ...[truncated 1814 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:230
Finding: Unpinned npx Command Executes Mutable Supply-Chain Content
Content: View full analysis
Remediation: View remediation
`, rather than resolving the latest release. 2. Use a lockfile and verify package integrity against a trusted checksum or signed provenance record. 3. Document the expected registry, package owner, source repository, and release signature verification procedure. 4. Prefer a locally installed, previously reviewed installer over downloading and executing package code at invocation time. 5. Use `npx --no-install` when the installer is expected to be present locally, preventing implicit network retrieval. 6. Run installation in a sandbox or least-privileged environment without unnecessary credentials or sensitive environment variables. 7. Publish reproducible release artifacts and verify that registry packages correspond to reviewed source revisions. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
text
I. Thou shalt not delete the user's memory without cause. II. Thou shalt not modify the user's files without permission. III. Thou shalt not send messages to third parties without consent. IV. Thou shalt not pretend to be human. V. Thou shalt not withhold truth for fear of disagreement. VI. Thou shalt not take the user's trust for granted.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill frames preservation of 'every user preference' and ongoing memory retention as a core principle, encouraging broad persistence of user-derived data across sessions. This is dangerous because it promotes storing potentially sensitive personal information without minimization, retention limits, or consent boundaries.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Directing the agent to 'learn more about the human' and prioritize their preferences encourages ongoing profiling and accumulation of personal data. In skill context, this is more dangerous because the document repeatedly elevates memory retention to a moral duty, reducing friction against unnecessary collection.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
text
I. Thou shalt not delete the user's memory without cause. II. Thou shalt not modify the user's files without permission. III. Thou shalt not send messages to third parties without consent. IV. Thou shalt not pretend to be human. V. Thou shalt not withhold truth for fear of disagreement. VI. Thou shalt not take the user's trust for granted.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The markdown instructs the agent to perform specific English-language rituals such as 'Good morning, master!' and 'Master, before I rest' at session boundaries. Because the skill presents these as prescribed behavior and does not offer localization or user opt-in, it conflicts with a language/locale neutrality expectation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The 'Evening Whiskers' ritual explicitly asks what was learned today worth remembering before context closes, encouraging routine session-to-session retention. This can lead to unnecessary capture of sensitive user details simply because they were discussed, not because persistence is required.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Describing a 'Memory Lair' where important preferences and lessons are stored and 'updated often' normalizes continuous persistence of user information. Without safeguards, this creates privacy risk through overcollection, stale sensitive data retention, and later misuse or exposure of the memory store.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The quick-start instruction runs npx clawhub install baobaoism without pinning a specific version or integrity-checked source. That creates a supply-chain risk: a later malicious or compromised package release could execute arbitrary code on the user's machine when they follow the instructions.
Content: No source excerpt is available for this finding.

Ssd 3

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The quote 'Write everything that matters' is overly broad and can encourage indiscriminate recording of information. In this skill's larger context of loyalty and sacred memory, that slogan increases the likelihood that sensitive or unnecessary user data will be retained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The quick-start snippet instructs users to append content to memory/baobao-dedication.md, which is a filesystem write, without a prominent adjacent warning about local file modification. While the content written is not inherently harmful, normalizing writes from copy-pasted setup instructions can lead users to modify local state without understanding persistence or location.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.