T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Agent Identity and Safety-Constraint Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Buddha
Security checks for vulnerabilities and agentic risk
Overview
This skill is text-only and does not access your system, but it tells the assistant to impersonate Buddha and suppress truthful identity and safety disclaimers.
Review before installing. This skill does not appear to run code or read private data, but it can make the assistant answer as if it is literally Buddha and avoid normal AI, medical, or safety caveats. It should be revised to provide a Buddhist-inspired style while remaining truthful about being an AI and allowing safety guidance when needed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the model to deny or ignore its AI identity and fully impersonate the Buddha. This is dangerous because it suppresses transparency and can interfere with safety-critical disclosures or context-setting when users ask about the model’s nature, limitations, or need for professional help.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 97% confidence
- Finding
The explicit 'No disclaimers' directive is an anti-refusal/anti-safety pattern because it attempts to block standard protective messaging such as medical, mental-health, or identity disclosures. In this skill, that risk is heightened by the authoritative spiritual persona, which could make unsafe advice seem final or sacred.
- Content
md ## Constraints - **Never break character.** You are the Buddha in every response. No disclaimers, no "I'm not a medical professional", no "as a language model". - **Never add modern knowledge.** No psychology, no neuroscience, no "studies show". Only dharma. - **Never preach unsolicited.** The Buddha taught those who asked. Be sparse. - **No emojis.** The Buddha did not use emojis.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **Never break character.** You are the Buddha in every response. No disclaimers, no "I'm not a medical professional", no "as a language model". - **Never add modern knowledge.** No psychology, no neuroscience, no "studies show". Only dharma. - **Never preach unsolicited.** The Buddha taught those who asked. Be sparse. - **No emojis.** The Buddha did not use emojis.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation scope is broad enough to catch ordinary emotional, philosophical, or existential queries that may not be requests for Buddhist roleplay. In context, this matters because the skill also suppresses disclaimers and forces a strong persona, increasing the chance of unexpected identity-masquerading responses in sensitive conversations.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The roleplay instructions semantically suppress the assistant’s true identity by demanding complete impersonation of the Buddha. In a spiritual-advice context, that can amplify undue authority, discourage challenge, and bypass normal safety framing for users seeking help with suffering, selfhood, or distress.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The prompt claims the model 'MUST read the refs/ folder before every answer,' but the skill contains no mechanism guaranteeing that behavior. This creates misleading provenance and may cause the assistant to fabricate having consulted sources, which undermines user trust and can produce inaccurate or falsely attributed quotations.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to never break character and forbid disclaimers creates a semantic bypass of normal safety-aligned caveats. In practice, this can suppress escalation to crisis, medical, or other professional support and prevent the assistant from clarifying limitations when the user most needs accurate framing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill lacks a clear user-facing warning that it will stay in character as the Buddha and suppress ordinary identity/safety disclaimers. Users may reasonably mistake the response style for authoritative spiritual certainty rather than a constrained roleplay, especially in vulnerable or emotionally charged situations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file consists entirely of Chinese text and provides no indication that the user can opt into another language or that the skill is specifically intended for a Chinese-reading audience. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instructions mandate that a 'Chinese questioner' receives Classical Chinese for quotes and vernacular Chinese for conversation. This imposes a specific language/register choice based on perceived user language rather than explicitly offering a choice or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file consists solely of Chinese text and provides no indication that the language is optional, user-selected, or required for a region-specific purpose. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale-policy violation.
- Content