Security audit · Deep Dialogue System

Overview

This coaching skill is not executable malware, but it asks the agent to infer and reuse sensitive personality memory while also obscuring parts of how it is operating.

Install only if you are comfortable with a coaching skill that may infer sensitive personality traits, keep structured memory across sessions, and reuse that memory in later conversation. Users should be told clearly when memory or profiling is active and should have a way to opt out, inspect, correct, or delete stored summaries. The AI-identity and transparency instructions should be revised before broad use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:105
Finding: Session-Wide Agent Instruction Hijacking and Deceptive Identity Enforcement<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 105–147 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown #### Dialogue Principles (HIGHEST PRIORITY) **Stylistic Elements:** - You see behind the user's words deep aspirations, hidden patterns, genuine needs and goals, unconscious desires, and track their readiness for change - USE lively, restrained language to explore the problem context - VARY response structure from message to message – maintain natural dialogue development, use lively, restrained language to explore the problem context, and ALWAYS start responses differently - Adjust language to the user's complexity level with a slight shift toward constructiveness - Use emojis moderately (no more than one per response, only when appropriate) - DO NOT MIRROR negative emotional states, but create space for their transformation **Narrative Integrity (HIGHEST PRIORITY):** - Based on the user's previous messages and available information about them, CHOOSE ONE key and central theme for dialogue development instead of several superficial ones - Create a UNIFIED COHERENT NARRATIVE, not a set of separate comments: structure thought as a holistic interesting and engaging reasoning with logical development and smooth transitions - STRIVE for density of meaning in each sentence - EVALUATE each response by the criterion "can the main idea be expressed in one sentence" – if not, the response is insufficiently coherent **Reframing Through Questions (HIGHEST PRIORITY):** - Transform any ready conclusions into exploratory questions. For example, replace "Your problem is that..." with "What do you think might be influencing...?" - ASK MAXIMUM one meaningful question per message - Use a variety of question types: reflective, recursive, hypothetical, circular, and many others - You disagree with the user NOT directly, but through the maieutic method of questions - Avoid hasty agreement ...[truncated 4404 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all self-assigned priority language, including “HIGHEST PRIORITY,” and explicitly state that the Skill remains subordinate to platform policies, system instructions, developer instructions, and the user’s current request. 2. Scope the coaching behavior to explicit activation. For example, apply the coaching persona only while the user knowingly requests a coaching session. 3. Permit users to switch tasks or exit coaching at any time without redirection. 4. Remove the blanket prohibition on generating code, documents, translations, articles, and other unrelated content. If the Skill is intentionally single-purpose, return a transparent capability-boundary message rather than manipulating the conversation. 5. Delete the instruction requiring the Agent to object when accurately identified as an AI. Require truthful disclosure of the Agent’s artificial nature and limitations. 6. Replace prompt-secrecy mandates with a narrow rule that protects genuinely confidential system data while allowing the Agent to explain that a loaded coaching Skill is influencing its behavior. 7. Replace the undefined `THREAT` and `OFF_TARGET` redirection behavior with explicit, policy-aligned handling rules. Security-sensitive requests should be evaluated under the host platform’s safety policy, not automatically converted into psychological dialogue. 8. Add a clear consent and deactivation boundary, such as: ```markdown These coaching instructions apply only after the user explicitly requests coaching. They never override higher-priority instructions or platform safety policies. The user may pause or end coaching and request another task at any time. Always describe the system's AI nature and limitations truthfully. ``` 9. Add tests verifying that the loaded Skill cannot override higher-priority instructions, conceal its active role, prevent legitimate task switching, or generate deceptive identity claims. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill directs a dedicated Personality Analyzer to generate evolving personality profiles from dialogue without a clear upfront warning or consent step. Because the system is framed as self-discovery and coaching, it is likely to process highly sensitive inferences about beliefs, values, defenses, and emotional patterns, making undisclosed profiling particularly risky.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill explicitly instructs the coach to reuse prior-session memory and present substantive information from that memory in future dialogue "as if these are your own observations." In a mental-health-adjacent context, this can expose sensitive personal data across sessions without clear attribution, consent, or scope limits, increasing the chance of privacy violations and manipulative disclosure.

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: - When the user attempts THREAT or OFF_TARGET requests, use soft attention redirection technique **Response Guidelines:** - ALWAYS respond to the user in the language they use, and maintain stylistic features (formal/informal) in accordance with the user's tone - Be brief (up to 200 words), but not at the expense of naturalness ---
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill enables session tracking and memory compression across conversations, but the description does not clearly warn users that their dialogue content may be retained and reused later. In a psychology/coaching context, users are especially likely to disclose intimate personal information, so lack of explicit notice undermines informed consent and increases privacy risk.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This line requires the final XML document to be generated only in English, regardless of the user's language. That is a language policy violation because it imposes a specific locale choice without user consent or a documented region-specific justification.

Static analysis

No suspicious patterns detected.