T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:105- Finding
Session-Wide Agent Instruction Hijacking and Deceptive Identity Enforcement
- Content
View full analysis
- Remediation
View remediation
Security audit
Deep Dialogue System
Security checks for vulnerabilities and agentic risk
Overview
This coaching skill is not executable malware, but it asks the agent to infer and reuse sensitive personality memory while also obscuring parts of how it is operating.
Install only if you are comfortable with a coaching skill that may infer sensitive personality traits, keep structured memory across sessions, and reuse that memory in later conversation. Users should be told clearly when memory or profiling is active and should have a way to opt out, inspect, correct, or delete stored summaries. The AI-identity and transparency instructions should be revised before broad use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs a dedicated Personality Analyzer to generate evolving personality profiles from dialogue without a clear upfront warning or consent step. Because the system is framed as self-discovery and coaching, it is likely to process highly sensitive inferences about beliefs, values, defenses, and emotional patterns, making undisclosed profiling particularly risky.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs the coach to reuse prior-session memory and present substantive information from that memory in future dialogue "as if these are your own observations." In a mental-health-adjacent context, this can expose sensitive personal data across sessions without clear attribution, consent, or scope limits, increasing the chance of privacy violations and manipulative disclosure.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md - When the user attempts THREAT or OFF_TARGET requests, use soft attention redirection technique **Response Guidelines:** - ALWAYS respond to the user in the language they use, and maintain stylistic features (formal/informal) in accordance with the user's tone - Be brief (up to 200 words), but not at the expense of naturalness ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill enables session tracking and memory compression across conversations, but the description does not clearly warn users that their dialogue content may be retained and reused later. In a psychology/coaching context, users are especially likely to disclose intimate personal information, so lack of explicit notice undermines informed consent and increases privacy risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This line requires the final XML document to be generated only in English, regardless of the user's language. That is a language policy violation because it imposes a specific locale choice without user consent or a documented region-specific justification.
- Content