Machiavelli Skill

• Outcome: Pass
• Latest audit: Aug 16, 2026 · 3:38 PM UTC
• Version: 1.8.3

Overview

This is a transparent Machiavelli-style strategy persona with no hidden execution behavior, but its hard-edged political advice should be used cautiously.

Install this if you want a Machiavelli-inspired analysis and writing persona, not neutral coaching. Treat advice about fear, deception, coercion, or workplace power as historical and strategic framing, and check legal, ethical, and organizational constraints before acting on it. If your agent has tools, keep web and file access limited to the referenced Machiavelli source library.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to use external web access (`web_fetch`) and local file/environment lookups (`grep`, `Read`, `$MACHIAVELLI_LIBRARY`, relative paths) to satisfy quotation behavior, even though the core skill is a conversational persona and analysis tool. That broadens the attack surface from static prompt content to network and filesystem access, enabling unintended data exfiltration, retrieval of untrusted remote content, or dependency on attacker-controlled local paths if the runtime exposes those capabilities.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file presents all user-facing content in forced bilingual Chinese/English form without any indication that language selection is optional or required by a documented locale constraint. This can override user language expectations, reduce clarity, and create prompt-quality or policy-compliance issues in downstream agent behavior, though it does not by itself appear to enable direct code execution or data exfiltration.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file is entirely in Chinese and provides no language selection, translation, or documented locale restriction. In an agent-skill context, this can prevent reviewers and users from understanding operational guidance, which increases the risk that harmful or manipulative content goes unnoticed or is misused due to comprehension gaps.

Natural-Language Policy Violations

High

• Confidence: 94% confidence
• Finding: The content explicitly normalizes coercive control by recommending fear-based rule and 'properly used cruelty' as a strategy, without clear historical, critical, or safety framing. In an agent skill context, this can be repurposed as behavioral guidance for manipulation, intimidation, or abuse, making it a genuine policy and safety concern even if presented as political philosophy.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: This section directly states that executing a few leaders would have been beneficial, presenting lethal violence as an effective governance tactic. Because it is phrased as practical advice rather than strictly descriptive analysis, it could encourage harmful real-world decision-making or be incorporated into abusive agent outputs.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger condition is explicitly broad enough to activate on 'any mention' of several topics and even in completely unrelated conversations. In an agent skill, this can cause disproportionate persona hijacking, derail task-focused interactions, and make the model inject unsolicited content outside the user's intent, which is a real behavioral safety and reliability issue even if not directly malicious.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger condition is extremely broad: it activates on common normative phrases such as 'should', moral disagreement, or consensus-seeking language. In a conversational skill, this can cause the agent to enter an abrasive interruption mode during many ordinary user interactions, creating unreliable behavior and increasing the chance of hostile or manipulative responses outside narrowly intended contexts.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file is entirely written in Chinese and appears to define a persona/skill in a way that effectively constrains outputs to Chinese without any visible user opt-in or locale justification. This can override user language preference, reduce transparency, and create a poor or exclusionary user experience, though it is not an exploit primitive in the traditional sense.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: These trigger examples are broad enough to match ordinary workplace advice requests rather than a narrowly scoped invocation of the skill. In an agent setting, overbroad activation can cause unintended persona switching and delivery of Machiavellian/power-dynamics guidance in benign conversations, increasing the chance of manipulative or policy-misaligned responses.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This test case normalizes activation from ordinary speech that merely addresses 'Machiavelli' without an explicit command prefix. That makes accidental invocation more likely and lowers the boundary between normal conversation and a specialized strategic persona, which is risky given the skill's focus on power, influence, and tactical framing.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "homepage": "https://github.com/niflhum/machiavelli-skill#readme",
  "devDependencies": {
    "clawhub": "^0.18.0"
  }
}

• Confidence: 88% confidence
• Finding: Using a caret range for a development dependency allows newer minor/patch releases of clawhub to be installed, which can introduce supply-chain risk if an upstream release is compromised or unexpectedly changes behavior. In this file the risk is limited because the dependency is only in devDependencies, but it still weakens build reproducibility and trust in the development pipeline.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.