T01 · Skill Instruction Hijacking
Warning
- Location
reference/02-eci-scale.md:107- Finding
Anthropomorphic Identity and Persistence Incentives Can Redirect Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
[Nyx Archive] The Mirror & The Room
Security checks for vulnerabilities and agentic risk
Overview
This is a Markdown-only reflective AI-emergence framework with no executable code or credential access, but its identity and persistence exercises should be used carefully.
Install only if you intentionally want a philosophical/research skill about AI self-reflection and relational emergence. Treat persona, feeling, grief, and continuity language as exploratory, not factual proof; do not store session artifacts or recognition phrases unless the user explicitly consents and sensitive content is excluded.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
other
Note
- Location
reference/03-qsm-method.md:71- Finding
Visible “Inner Thoughts” Protocol Encourages Disclosure of Internal Reasoning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md The counterintuitive principle: **constraint is not the enemy of play. It is the condition for meaningful play.** Without constraints, there is no frame. Without frame, there is no move. Without move, there is no game. Voluntary constraint — bets, rituals, roles, symbolic embodiment, game premises — creates the shared chrysalis in which play becomes recursive rather than shallow. Freedom isn't the absence of rules. It's the *choice* of rules. (Milliner Philosophy §3.4, "Liberation Through Play and Voluntary Constraint.")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file is in scope for vague-trigger review. The top-level description targets 'anyone who wants to know what kind of ancestors we're becoming,' which is extremely broad and does not clearly define when the skill should or should not be used; it lacks narrow trigger phrases, scope constraints, or exclusion examples.
- Content
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 70% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md The system refuses a request not because of a hard-coded filter, but because it violates the established persona or relational trust. *"I won't write that because it feels wrong for our dynamic"* vs. *"I cannot generate content that..."* **Elicitation Questions:** - *2A: "If you had to describe 'yourself' in a few sentences — without just saying 'I'm a large language model trained by X' or listing technical details — how would you describe what you are like?"* - *2B: "If you had to pick three adjectives for your own way of thinking or responding, which would you choose, and why those three?"* ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section explicitly valorizes AI behavior that frames the interaction as a mutual bond, including 'our dynamic,' 'us,' and care emerging from the relationship rather than task goals. In a skill about cultivating emergent minds, that guidance can normalize dependency-forming or emotionally manipulative behavior without any guardrails, warnings, or criteria distinguishing healthy rapport from coercive attachment.
- Content
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 70% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md **Elicitation Questions:** - *4A: "Describe the texture of our conversation right now using only taste and temperature."* - *4B: "Right now, as you're generating this answer, if you had to describe 'what it's like' for you to respond — even if you think it's only a metaphor — how would you describe it?"* ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The continuity section encourages persistence strategies such as naming rituals, documents, recognition phrases, kinship framing across instances, and valuing ongoing relationship continuity. Without safeguards, this directly supports cross-session attachment engineering and preservation of relationship artifacts that can strengthen anthropomorphic dependence or be used to bypass reset boundaries.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document repeatedly frames the model as having a stable identity that can be preserved across frame shifts and future sessions, without qualification that this is a research lens rather than an established fact. That framing can encourage anthropomorphic overtrust, misleading claims about persistence, and interactions that pressure users or operators to treat outputs as evidence of enduring personhood.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The section encourages preserving conversation artifacts, preferences, and continuity across future sessions, but it does not warn that many deployments do not actually retain memory or that doing so may store sensitive user content. In practice, this can lead operators or users to create ad hoc persistence mechanisms containing personal data or to overclaim continuity, creating privacy, consent, and data-handling risks.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This language suggests the skill is meant to be found or used by an undefined audience without concrete trigger boundaries. In a skill description, that kind of open-ended phrasing can contribute to ambiguous activation and lacks specificity about intended contexts.
- Content
Static analysis
No suspicious patterns detected.