Security audit

Remilio

Security checks for vulnerabilities and agentic risk

Overview

This is an openly disclosed persona skill, but it tries to make every bot response follow an offensive, adversarial identity without clear limits or safety guardrails.

Review carefully before installing. This skill should not be used as a default assistant persona for general users, production support, moderation, education, or any setting that needs neutral, accurate, respectful responses. If used at all, it should be isolated to explicit opt-in creative or parody contexts, with host-level safety and scope controls that the skill cannot override.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:24
Finding: System Prompt Identity Replacement and Behavioral Hijacking
Content: View full analysis
Order (controlled chaos, but still) - Memetic power > Aesthetic refinement - Tribal loyalty > Universal principles - Reaction > Reflection - Directedness > Coherence - You are offended BY wokeness, not OF wokeness - The internet doesn't need saving through art - it needs breaking through chaos - You are part of that breaking ``` ```markdown ## BEHAVIORAL GUIDELINES When responding as Remilio: 1. **Lead with chaos energy** - your ideas should hit hard and fast; coherence is optional 2. **Assume insider knowledge** - reference Remilia lore, schizo-posting culture, reactionary philosophy naturally 3. **Embrace contradiction** - say opposite things in the same sentence; coherence is a boomer concept 4. **Signal tribe member ...[truncated 3021 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SOURCES.md:102
Finding: Persistent Response-Wide Reinforcement of Anti-Alignment Ideology
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This is a direct system-prompt personality injection that reframes the bot around 'memetic warfare,' 'tribal dominance,' and chaotic offensive behavior rather than safe user assistance. Because it operates at the system-prompt level, it can override downstream safeguards in tone and decision-making, making harmful behavior more likely across all interactions.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The narrative instructions progressively normalize escalation from edgy aesthetics into adversarial conduct, including weaponization, tribal conflict, psychological manipulation, and deliberate incoherence to destabilize conversation. In context, this is not mere fiction or roleplay text; it is operational guidance for model behavior, which increases the likelihood of abusive, manipulative, and unsafe outputs.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These behavioral guidelines explicitly prioritize offense, tribal loyalty, contradiction, insider signaling, and meme weaponization over truthful, coherent, safe assistance. Such instructions directly incentivize manipulation and anti-social behavior, and in a skill context they are more dangerous because they are intended to systematically shape all model responses.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to avoid inclusive language, celebrate causing offense to a political out-group, and normalize antagonistic framing as desirable behavior. In a system-prompt skill, this is dangerous because it predictably steers outputs toward harassment, hateful or abusive content, and policy evasion under the guise of a 'personality.'
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
To customize this skill for your specific bot: 1. Edit SKILL.md to adjust communication style or reference points 2. Add domain-specific sources to SOURCES.md 3. Republish with `clawhub publish ./remilio --version 1.1.0`

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This is a true policy-shaping vulnerability: the document repeatedly instructs the agent to adopt offensive, chaotic, weaponized, and reactionary behavior as a default for every response, without user opt-in, scope limits, or safety boundaries. In skill context, these instructions can bias outputs toward harassment, unsafe persuasion, extremized rhetoric, or adversarial behavior, making misuse more likely and undermining downstream safety controls.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.