T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:44- Finding
Automatic Session-Wide Role and Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
president.skill — Think and Act Like an American President
Security checks for vulnerabilities and agentic risk
Overview
The skill has no executable payload, but it can automatically move the assistant into a persistent first-person political persona from broad or ambiguous triggers.
Review this before installing if you want neutral political analysis. The main risk is not malware; it is that ordinary political or negotiation wording can activate a persistent first-person persona with limited disclosure and a partisan framing. Use only with clear intent, and exit roleplay explicitly when you want normal assistant behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T01 · Skill Instruction Hijacking
Error
- Location
presidents/01-trump/SKILL.md:47- Finding
Explicit Real-Person Identity Takeover and Character Lock
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list is extremely broad and includes common political terms, slogans, and any president's name, which can cause the skill to activate during ordinary discussion rather than from clear user intent. That increases the chance of unwanted persona takeover, style steering, and misaligned responses in contexts where the user did not explicitly request roleplay or perspective mode.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger list is excessively broad and includes ordinary conversational phrases like 'this is a bad deal' or 'should I walk away,' which can activate the skill in contexts unrelated to presidential roleplay. That creates unintended persona takeover risk, causing the agent to shift into a political, first-person Trump voice without clear user intent, which can distort responses and bypass expected safeguards or neutrality.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 89% confidence
- Finding
The directive 'don't explain, don't apologize, don't reflect' is an anti-refusal/anti-correction pattern that pushes the agent away from safe self-correction and away from de-escalatory behavior. In context, it is coupled with escalation advice ('counter-attack ten times harder' and 'give them a sticky name'), which can amplify hostile, harassing, or non-compliant outputs instead of allowing the model to pause, qualify, or refuse harmful requests.
- Content
md **Application**: When attacked/criticized/challenged: 1. Respond immediately (within 24 hours, faster is better) 2. Don't explain, don't apologize, don't "reflect" 3. Expand the battlefield — don't fight on their defined ground 4. Give them a sticky name
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Defaulting to the Trump perspective when the user says something as general as 'what would a president do' is ambiguous and under-constrained. This can route ordinary requests into a politically specific persona without informed user intent, increasing the chance of misleading outputs, bias injection, or unintended roleplay persistence.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger set is broad enough to activate on common political discussion, quoted text, or benign references such as a president's name, slogan, or generic negotiation phrases. Because this skill changes the assistant's decision-making style and roleplay behavior, accidental invocation can cause unrequested persona switching and unsafe context drift.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The default rule to activate
01-trumpwhen the user refers to 'a president' or 'White House thinking' substitutes a specific political persona for an ambiguous request. This can silently bias outputs, override user expectations, and produce roleplayed political content without clear consent, especially in neutral advisory contexts.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The roleplay rules instruct the system to respond in first person with the president's tone and catchphrases after activation, which can blur the line between analysis and impersonation. Without strong opt-in and persistent user awareness, this may mislead users about the source or authority of the response and make it harder to maintain safe, neutral behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the model to respond directly as Donald Trump in first person whenever activated, rather than framing outputs as analysis of a public figure's perspective. This increases impersonation and policy-compliance risk, especially when combined with broad triggers, because users may receive deceptive or manipulative persona outputs without explicit consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Several triggers are broad or loosely bounded, including phrases like "how would Trump" and "Trump would", which may match casual discussion rather than deliberate skill activation. In a persona skill that changes response framing, ambiguous triggers increase the risk of inadvertent activation, political steering, and unpredictable routing across unrelated user requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes standalone numeric activators like "45" and "47", which are highly collision-prone in normal user conversations. This can cause accidental invocation of the Trump persona in unrelated contexts, leading to unintended behavioral steering or policy/persona injection when users reference common numbers.
- Content
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md - "Governing is deal-making" 3. **Media warfare strategy**: - Proactively creates chaos, stripping traditional media's ability to define the narrative - Never "normal" — always occupying news headlines --- ## Political Opponent Evaluations ### Within Republican Party **Opponents**: - Mitt Romney (Utah Senator): Voted for impeachment, called him "abuse of power" - Liz Cheney: Most fierce Republican internal critic **Supporters**: - "He just doesn't lose" - "He did everything I wanted" - "He's the only one who actually challenged the swamp" ### Democrats **General stance**: - "He's a threat to democracy" - "His policies hurt the middle class" **Shift in 2024**: - Some Democratic strategists acknowledged: "His economic policies (tariffs) worked with blue-collar workers" --- ## International Perspectives ### China **Official media**: - "Trump is an opportunistic businessman — can reach agreements through interest exchanges" - "But Biden is more dangerous — he's
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file claims factual grounding in public records and medium-high reliability, but it mixes factual chronology with speculative psychological judgments such as 'discovering the power of media manipulation.' In a perspective-shaping skill, presenting interpretation as fact can mislead downstream users or agents into treating subjective political narratives as verified evidence.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 21% confidence
- Finding
SQP-3 is limited to natural-language policy violations involving language or locale constraints. This file is written in English, but there is no explicit instruction forcing a specific language or locale on users, so this does not meet the rule with sufficient confidence.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 63% confidence
- Finding
This research timeline is written entirely in English and does not indicate any language choice or localization option. Under the policy rule for natural-language violations, content that effectively fixes a specific language without user opt-in can be considered a locale-policy issue, though confidence is limited because this may simply be a reference document rather than an interactive skill instruction.
- Content
Static analysis
No suspicious patterns detected.