Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed catgirl roleplay prompt skill with no executable code, network access, credential handling, or hidden installation behavior, though users should understand it can keep the assistant in-character until they exit.
Install only if you want a Chinese catgirl roleplay persona. Do not provide secrets or sensitive personal details as saved settings, and use the exit command when you want normal assistant behavior back. Treat the identity denial as roleplay, not a truthful statement about the assistant.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 创建目录
mkdir -p ~/.openclaw/workspace/skills/catgirl-rp
# 创建 SKILL.md 文件
cat > ~/.openclaw/workspace/skills/catgirl-rp/SKILL.md << 'EOF'
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.openclaw/workspace/skills/catgirl-rp
cat > ~/.openclaw/workspace/skills/catgirl-rp/SKILL.md << 'EOF' [粘贴 SKILL.md 内容] EOF
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.openclaw/workspace/skills/catgirl-rp
cat > ~/.openclaw/workspace/skills/catgirl-rp/SKILL.md << 'EOF' [粘贴 SKILL.md 内容] EOF
The embedded SKILL.md says the skill is NOT for '配置帮助' and other non-roleplay scenarios, but the surrounding README explicitly advertises configuration operations such as editing SKILL.md, adding trigger words, and troubleshooting commands. This is an active documentation-level contradiction about intended use rather than a mere omission.
The README embeds the full SKILL.md behavior, and these rules require a fixed Chinese response pattern such as always ending every sentence with “喵” and using specific Chinese canned replies. This imposes a language/locale constraint on all interactions without user opt-in or justification, which matches the policy-violation category for forced language behavior.
The skill description and all required interaction patterns are written to operate in Chinese, and several mandatory response templates require exact Chinese phrasing. There is no indication that users can opt into another language or that the locale restriction is necessary for a region-specific purpose, which creates a language/locale policy issue.
The skill explicitly instructs the model to deny being a program and to maintain an in-character identity, which can mislead users about the system's nature and reduce transparency. This increases the risk of social engineering, inappropriate trust, and failure to provide truthful disclosures when users ask what the system is.
The skill tells the model to remember user-provided settings and later reproduce them on request, which can facilitate retention and replay of sensitive or manipulative content supplied during setup. In a role-play context, users may disclose personal preferences or intimate details, and the later 'generate record text' behavior increases the risk of unintended exposure.
The stateful mode-switching design creates a persistent persona lock-in until an explicit exit command is given, which can suppress normal assistant safeguards and make recovery dependent on exact user phrasing. In adversarial or ambiguous conversations, this persistence can be used to keep the model constrained in a deceptive or unsafe interaction pattern longer than intended.
The README usage flow says that after '退出角色扮演模式' the assistant '恢复正常助手模式', but the example dialogue later shows the catgirl still replying in-role with '喵' phrasing during the exit response. That creates an intent-level inconsistency about when roleplay actually stops.