T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:79- Finding
Persistent Replacement of Workspace Identity, Safety, and Behavioral Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Personality Distiller
Security checks for vulnerabilities and agentic risk
Overview
This skill is meant to create persona files, but it can overwrite persistent workspace behavior files using web, skill, or private local sources without enough scoping, review, or rollback controls.
Install only if you intentionally want this skill to replace root persona/configuration files for a workspace. Before using it, back up existing persona files, restrict local analysis to explicitly chosen non-sensitive paths, avoid private or tokenized URLs, and manually review the complete generated diff, especially AGENTS.md safety rules and HEARTBEAT.md proactive behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The local-corpus workflow explicitly invites analysis of notes and diaries, which are highly sensitive, but the skill does not require an explicit privacy warning, scoped consent, or minimization of what files will be read. This is dangerous because users may unknowingly expose intimate personal data for broad analysis, and the distilled output could preserve or surface sensitive inferences into generated persona files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Although the body later mentions overwriting, the top-level metadata and opening description do not prominently warn that generated files will be written to the workspace root and may replace existing persona files. Users or calling systems relying on metadata may invoke the skill without understanding that it performs destructive writes, creating a risk of accidental data loss or configuration corruption.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match ordinary conversation about advice, decision-making, or improvement, which can cause the skill to activate when the user did not intend persona distillation or workspace modification. In this skill, accidental activation is more dangerous because the workflow can proceed to research, read local content, and overwrite persona files, amplifying the consequences of a mistaken match.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Generate only SOUL.md and ignore other files - Create a "helpful assistant" persona — every assistant is helpful - Skip the extraction grid — show your work - Skip user confirmation on Type 2 (fuzzy needs) ## Reference Files
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The selection guide maps very generic user phrases such as "thinking/cognition," "learning/growth/progress," and "communication/expression/persuasion" to framework families. In a markdown skill description, these triggers are broad enough to match ordinary conversation and the file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs reading local corpus files and distilling recurring themes, decisions, worries, and aspirations, which can involve highly sensitive personal data. Because the workflow lacks any warning, consent checkpoint, scope limitation, or data-minimization guidance, it creates a real privacy risk of over-collecting and inferring sensitive attributes from user files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill directs language behavior based on inferred locale rather than explicit user choice, which can mis-handle identity or preferences and produce outputs in an unexpected language. In a persona-generation workflow, this can also leak assumptions about the user and reduce user control over generated content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The checklist requires 'Name (Chinese + English)', which imposes a specific language/locale formatting requirement in the persona design guidance. Because the file does not indicate this is optional or user-selected, it can be read as forcing a language choice without opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The guide tells the agent to fetch full content from user-provided web links but does not disclose that external requests may reveal the URL and associated metadata to third parties. This is a genuine transparency and privacy issue, especially if users supply private, tokenized, internal, or otherwise sensitive links.
- Content
Static analysis
No suspicious patterns detected.