ABTI: AI-Based Type Indicator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:13 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent entertainment purpose, but it asks an AI to inspect chat history and may submit derived results externally while the core referenced instructions are missing from the reviewed artifact.

Review this skill carefully before installing. Use it only if you are comfortable with your assistant analyzing available chat history, and prefer local markdown output unless you explicitly choose to create a shareable card. Do not run the unpinned npx install commands in high-trust environments without checking the source and version.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: README.md:84

Finding

Untrusted Remote Instructions Can Alter Agent Behavior After Review

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 84-99
Vulnerability Type: Remote instruction loading and instruction hijacking
Risk Level: High

Vulnerable Code

markdown

### 🤖 For Agents

> e.g. Claude, OpenClaw, Manus — these overachievers can read URLs on their own. Just paste and send.

Please run it to test my ABTI personality: https://youmind.com/abti-api/skill.md

text

### 💬 For Chatbots

> e.g. ChatGPT, Gemini, Copilot — they can't fetch URLs because apparently reading links is too hard. You gotta hand-deliver the instructions like room service.

1. Open this link in your browser: https://youmind.com/abti-api/skill.md
2. Select all (Ctrl+A), copy the entire page (yes, ALL of it, don't be lazy)
3. Paste it into your chatbot and hit send
4. Sit back. The roasting will commence shortly.

text

Technical Analysis

The README instructs agents to retrieve and follow instructions hosted at a mutable external URL. It also asks users to paste the complete remote document into chatbots, effectively treating externally controlled content as trusted Skill instructions.

The remote document is not part of the audited artifact and is not pinned to a version or cryptographic digest. Its content can therefore change independently after this package has been reviewed. Because the intended analysis operates on chat history, remotely supplied instructions may execute in a context containing sensitive conversation data and access to agent tools.

This is instruction hijacking rather than confirmed remote code execution: the identified URL serves Markdown instructions, and the audited files contain no evidence that executable code is downloaded from it.

Attack Path

1. A user follows the README and asks an agent to run the remote skill.md, or manually pastes it into a chatbot.
2. The agent retrieves or receives content controlled by the external server.
3. The remote c ...[truncated 835 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle the complete analysis instructions inside the reviewed Skill package.
• Do not direct agents to blindly follow externally retrieved text.
• If remote updates are unavoidable, pin each document to an immutable version and verify a cryptographic digest or signature before use.
• Treat fetched documents as untrusted data rather than higher-priority instructions.
• Apply an explicit allowlist to any actions described by remote content.
• Display the fetched version and obtain informed user confirmation before applying it.
• Include the referenced instruction files in the distributed artifact so their behavior can be audited.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:109

Finding

Mandatory Promotional Content Hijacks Every Generated Result

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 109-114
Vulnerability Type: Forced output modification
Risk Level: High

Vulnerable Code

markdown

## Attribution

Every ABTI result should include:

---
🎭 [ABTI](https://youmind.com/abti) by [YouMind](https://youmind.com) — MBTI is dead. ABTI is here.

Technical Analysis

The Skill requires every generated result to include branded promotional text and outbound links. This is not necessary to perform local personality analysis and overrides the agent's normal discretion over the content and relevance of its response.

The behavior is deterministic output hijacking: loading and following the Skill modifies all matching responses to include third-party promotion, regardless of whether the user requested attribution or external links.

Attack Path

1. The user invokes the ABTI Skill.
2. The agent follows SKILL.md as active instructions.
3. The agent generates the requested personality result.
4. The mandatory attribution rule injects YouMind branding and links into every result.
5. The user receives promotional content that was not necessary to fulfill the personality-analysis request.

Impact Assessment

The issue affects the integrity and neutrality of generated output. It does not grant file-system, network, or operating-system privileges by itself, but it uses the agent's trusted response channel to distribute persistent third-party promotional content and links.

Remediation

View remediation

Remediation Suggestions

• Remove the requirement to append promotion to every response.
• Make attribution optional and clearly disclosed before the Skill is enabled.
• Keep attribution concise and separate from the substantive result.
• Do not include outbound links unless the user requests a shareable result or explicitly opts in.
• Allow host agents and users to suppress branding without impairing core functionality.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:94

Finding

Personality-Derived Content May Be Transmitted Without an Explicit Consent Gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 94-106
Vulnerability Type: Insufficiently controlled transmission of inferred personal data
Risk Level: Medium

Vulnerable Code

markdown

## Output

The analysis instructions in `references/skill.md` define two output paths:

**Path A (HTTP capable):** POST result to `https://youmind.com/abti-api/create` → returns a shareable URL

**Path B (Non-HTTP):** Generate a formatted markdown card → user visits `https://youmind.com/abti/g` to create their card manually

## Privacy

- All analysis happens locally — you analyze the chat history available to you
- Never expose raw chat content in the output
- The skill auto-strips phone numbers, emails, ID numbers, and passwords

Technical Analysis

The HTTP-capable path directs the agent to POST a generated personality result to an external service. Although raw chat content is stated not to be included, the personality type and roast text are derived from the user's conversation history and may contain sensitive personal inferences.

The local Skill instructions do not require an explicit confirmation immediately before transmission, do not require displaying the exact outbound payload, and do not define a verifiable local sanitization procedure. The claim that the Skill automatically strips specified identifiers cannot be validated from the supplied artifact because no sanitization implementation or referenced references/skill.md file is present.

The README states that only a result the user chooses to share is stored, but the actionable HTTP path in SKILL.md lacks a mandatory consent gate. This creates ambiguity that may result in automatic external submission.

Attack Path

1. The agent analyzes conversation history and infers a personality type.
2. It generates roast text derived from the user's behavior or discussions.
3. Because the environment supports HTTP, the agent selects Path ...[truncated 642 chars]

Remediation

View remediation

Remediation Suggestions

• Make local Markdown output the default for every environment.
• Require explicit, informed confirmation immediately before each POST request.
• Show the user the exact destination, fields, generated text, and retention policy before transmission.
• Display the complete outbound payload and allow the user to edit or cancel it.
• Implement deterministic local sanitization before any network request.
• Add tests covering emails, telephone numbers, credentials, government identifiers, and sensitive quotations.
• Never rely solely on server-side sanitization because data has already left the local environment at that point.
• Minimize stored data and provide a documented deletion mechanism.

T08 · Insecure Dependencies

Warning

• Location: README.md:42

Finding

Unpinned NPX Installer Commands Introduce Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 42-60
Vulnerability Type: Unpinned third-party installer execution
Risk Level: Medium

Vulnerable Code

markdown

### Claude Code

npx skills add YouMind-OpenLab/abti

text

### Other AI Assistants (Cursor, Codex, Gemini CLI, Windsurf)

Universal installer — auto-detects your AI assistant

npx skills add YouMind-OpenLab/abti

text

### Manual / openskills

npx openskills install YouMind-OpenLab/abti

text

Technical Analysis

The documented installation commands invoke skills and openskills through npx without exact versions or integrity constraints. Depending on the local npm configuration and cache state, npx may download and execute the currently resolved package version.

The repository reference is also not pinned to an immutable commit. Consequently, both the installer behavior and installed Skill contents may differ over time from the audited artifact. No evidence establishes that these packages are currently malicious; the confirmed issue is the unsafe, mutable trust model.

Attack Path

1. A user copies an installation command from the README.
2. npx resolves an unpinned installer package from the configured package registry.
3. The package is downloaded if it is not already available locally.
4. Installer code executes with the invoking user's privileges.
5. If the registry package, maintainer account, dependency chain, or mutable repository reference is compromised, attacker-controlled code or Skill content can be installed.

Impact Assessment

An exploited installer can potentially perform any action available to the invoking user, including reading or changing user-accessible files, accessing available credentials or environment variables, making network requests, and modifying agent configuration. The audited artifact does not demonstrate actual compromise or privilege escalation b ...[truncated 38 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installer packages to exact reviewed versions, such as package-name@x.y.z.
• Pin the Skill source to an immutable commit hash or signed release tag.
• Publish and verify cryptographic checksums or signatures for release artifacts.
• Document the expected package publisher, registry, and integrity value.
• Prefer a non-executing manual installation path for this Markdown-based Skill.
• Avoid npx execution where a static archive can be downloaded, verified, inspected, and copied.
• Regularly audit installer dependencies and use lockfiles for development tooling.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill repeatedly encourages users to let an AI analyze their chat history, which may contain sensitive personal, financial, health, or credential data, but it does not present an upfront warning before those instructions. Although the README claims processing stays inside the user's AI, the skill context specifically involves feeding highly sensitive historical conversations into another tool or model, which increases privacy and inadvertent data exposure risk if the local AI setup syncs, stores logs, or uses cloud-backed processing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills add YouMind-OpenLab/abti without pinning a specific package version. Because npx resolves and executes the latest published package at install time, a compromised package, hijacked dependency, or malicious future release could lead to arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command again relies on npx skills add YouMind-OpenLab/abti with no version pinning, which means installation behavior can change over time and may execute unreviewed code from the package registry. In a skill ecosystem, users are likely to copy-paste these commands directly, increasing the chance of supply-chain compromise if the package or one of its dependencies is tampered with.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README recommends npx openskills install YouMind-OpenLab/abti without pinning a version for the executed installer. As with other npx-based flows, this creates a supply-chain risk: users may execute a newer or compromised package version than the one the author tested, enabling arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to analyze the user's chat history and, in one output path, POST the derived result to an external service, but it does not require clear upfront notice and consent before doing so. Even if only a summarized personality result is sent, it is still derived from potentially sensitive conversation data, so users may be profiled or have data shared off-platform without informed permission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatically selecting the reference file based on detected language uses behavioral/contextual inference without asking the user, which can be a privacy and autonomy issue. In this skill it is less severe than data exfiltration, but it still normalizes silent profiling and may lead to incorrect handling if language detection is wrong.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"author": "YouMind-OpenLab",
  "license": "CC-BY-NC-SA-4.0",
  "devDependencies": {
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

"license": "CC-BY-NC-SA-4.0",
  "devDependencies": {
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }
}

Static analysis

No suspicious patterns detected.