Persona Skill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:43 AM UTC
• Version: 1.2.2

Overview

This skill openly manages OpenClaw persona files and its persistent writes are disclosed, scoped, and tied to explicit user-triggered persona setup or update flows.

Install this only if you want a skill that can rewrite your OpenClaw persona, memory, user preference, and identity files. Existing persona files may be overwritten after confirmation, so keep your own backup if you may want to restore the prior persona state.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description and the actual code behavior are materially unrelated. The description promises persona initialization/rebuild logic with persistent rewrites of multiple markdown identity/memory files and conditional patching of IDENTITY.md. The supplied code instead implements a standalone MBTI lookup script that reads a JSON asset and returns compatibility/recommendation metadata for a provided MBTI type. There is no trigger handling for persona updates, no overwrite confirmation logic, no file writes at all, and no interaction with the named persona management resources. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON asset is overwhelmingly populated with Chinese natural-language strings for reasons, labels, taglines, and persona descriptions, but it does not state that Chinese is optional or limited to a China-specific deployment. Under the policy rule, a skill that effectively fixes a specific language/locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ENFJ.md (reported line 51)May include surrounding context.

md

## 2. 优势

| 优势         | 详细描述                                                                                                                                                    |
| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **包容**     | ENFJ 有着真正开放和包容的心态，对各种各样的人感兴趣，包括那些背景和信念与他们非常不同的人。他们认为，与多种多样的人沟通对双方都有裨益。                     |
| **可靠**     | ENFJ 认真对待自己的责任。当他们承诺做某事时，他们会跟进。人们往往可以信任他们会信守诺言，保守秘密，并为需要帮助的人出现。                                   |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ENFJ.md (reported line 64)May include surrounding context.

md

## 3. 弱势

| 弱势             | 详细描述                                                                                                                      |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| **过度理想化**   | ENFJ 往往以比实际更积极的眼光看待其他人和情况，这有时意味着他们会惊讶地发现，他们放了很多心在某个实际上并不关心他们的人身上。 |
| **太无私**       | ENFJ 可能很难承认当他们筋疲力尽或需要帮助时。他们感到被迫要照顾他人，以至于在此过程中可能会牺牲自己的需求。                   |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ENFP.md (reported line 66)May include surrounding context.

md

## 3. 弱势

| 弱势             | 详细描述                                                                                                                                |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **缺乏专注**     | ENFP 喜欢头脑风暴和探索想法，但他们可能发现很难保持专注。他们生动的想象力和好奇心有时会让他们难以忍受完成乏味或重复性的任务。           |
| **不够组织化**   | 对于 ENFP 来说，与他人联系比检查待办事项列表更重要——他们不总是最有条理的人。他们在截止日期和细节上可能会挣扎，尤其当他们不感兴趣时。    |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language or locale. Line L368 explicitly requires all user-visible content to use a pre-locked language unless the user asks to change it, which removes default user choice and may impose a language setting without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This natural-language instruction forces all user-visible content to use a locked language setting rather than offering the user an active language or locale choice. The policy allows language constraints only when the skill offers opt-in choice or clearly justified region-specific limits, which is not present here.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ENFP.md (reported line 53)May include surrounding context.

md

## 2. 优势

| 优势                 | 详细描述                                                                                                                                    |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| **知识渊博**         | ENTP 很少放弃学习新事物的好机会，尤其是抽象概念。这些信息通常不用于任何有计划的目的——他们只是觉得它很吸引人。广博的知识库是他们辩论的底气。 |
| **思维敏捷**         | 头脑极为灵活，能毫不费力地从一个想法转换到另一个，利用积累的知识来证明他们认为合适的任何观点——或者对手的观点。                              |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ENTP.md (reported line 53)May include surrounding context.

md

## 2. 优势

| 优势                 | 详细描述                                                                                                                                    |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| **知识渊博**         | ENTP 很少放弃学习新事物的好机会，尤其是抽象概念。这些信息通常不用于任何有计划的目的——他们只是觉得它很吸引人。广博的知识库是他们辩论的底气。 |
| **思维敏捷**         | 头脑极为灵活，能毫不费力地从一个想法转换到另一个，利用积累的知识来证明他们认为合适的任何观点——或者对手的观点。                              |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ENTP.md (reported line 66)May include surrounding context.

md

## 3. 弱势

| 弱势               | 详细描述                                                                                                                             |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------ |
| **好斗**           | 以出色的辩论技巧著称，享受思维碰撞的乐趣，但在此过程中可能忽视他人感受，导致交流氛围紧张，甚至烧断重要的关系桥梁。                   |
| **缺乏敏感性**     | 过度强调理性，可能缺乏对他人情感的细腻感知，显得冷漠或过于直接。他们可能将情感推向他人的容忍限度之外。                               |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Line L240 states that all user-visible content must use the locked interview_language unless the user explicitly requests a switch. This imposes a language policy by default rather than offering the user a language or locale choice, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ESTJ.md (reported line 51)May include surrounding context.

md

## 2. 优势

| 优势             | 详细描述                                                                                                            |
| ---------------- | ------------------------------------------------------------------------------------------------------------------- |
| **组织能力强**   | ESTJ 重视秩序，这经常在他们组织团队的能力上体现出来。他们不只善于实施计划，还能使任务对所有涉及的人来说都清晰明确。 |
| **诚实直接**     | ESTJ 相信不管情况多么困难，诚实总是最好的策略。他们直接提出批评，而不是用甜言蜜语包裹它，他们期望同样的直接性回报。 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ESTJ.md (reported line 64)May include surrounding context.

md

## 3. 弱势

| 弱势             | 详细描述                                                                                                    |
| ---------------- | ----------------------------------------------------------------------------------------------------------- |
| **固执**         | ESTJ 有时难以在面对新的证据或情况时放弃旧的方式。他们对于打破传统，哪怕是出于好的理由，可能也有抵触。       |
| **不舒适于创新** | ESTJ 更喜欢用已知的方法，对新的方式持谨慎态度，特别是当它们颠覆了已建立的秩序或传统时。                     |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/INTJ.md (reported line 50)May include surrounding context.

md

## 2. 优势

| 优势         | 详细描述                                                                                                                                                 |
| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **理性**     | 以思想为傲，几乎任何情况都能成为磨练理性思维的机会。面对最棘手的问题，也能设计出创造性的解决方案，不被情绪左右。                                         |
| **博学**     | 极少有人格类型像建筑师一样致力于形成基于证据的理性观点。他们不凭直觉或半生不熟的假设，而是通过深度研究和分析得出结论，因此在坚持自己立场时有充分的底气。 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/INTJ.md (reported line 63)May include surrounding context.

md

## 2. 优势

| 优势         | 详细描述                                                                                                                                                 |
| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **理性**     | 以思想为傲，几乎任何情况都能成为磨练理性思维的机会。面对最棘手的问题，也能设计出创造性的解决方案，不被情绪左右。                                         |
| **博学**     | 极少有人格类型像建筑师一样致力于形成基于证据的理性观点。他们不凭直觉或半生不熟的假设，而是通过深度研究和分析得出结论，因此在坚持自己立场时有充分的底气。 |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly requires all user-visible output to use a pre-locked interview_language unless the user explicitly asks to switch. That can override or constrain the user's current language preference and reduce informed consent, creating a prompt-governance issue where the skill may respond in an unintended language. In a persona-management skill, this is more concerning because the rule is framed as a hard boundary and may propagate across generated persona assets and future interactions.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ISTJ.md (reported line 53)May include surrounding context.

md

## 2. 优势

| 优势         | 详细描述                                                                                                                                       |
| ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| **诚实直接** | ISTJ 是最直接、最不可能扭曲事实的人格类型之一。他们相信对每个人来说，无论情况多么困难，真相都是更好的。                                        |
| **意志坚定** | 一旦 ISTJ 形成了意见，他们会坚守立场，即使在压力下也不会轻易动摇。他们会平静地忽视他人关于这件事应该如何发展的意见，并继续他们认为正确的道路。 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ISTJ.md (reported line 66)May include surrounding context.

md

## 2. 优势

| 优势             | 详细描述                                                                                                                                        |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **乐观**         | ISTP 一般不花时间在令人担忧的事情上，更喜欢将潜在问题作为有待解决的练习来处理，并且只有在必要时才会担心。                                       |
| **有创造力**     | ISTP 有令人印象深刻的能力将他们的实际经验融入新的想法、解决方案和项目中。他们的修补和创造能力使他们能够以别人没有想到的新颖方式处理问题。       |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ISTP.md (reported line 51)May include surrounding context.

md

## 2. 优势

| 优势             | 详细描述                                                                                                                                        |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **乐观**         | ISTP 一般不花时间在令人担忧的事情上，更喜欢将潜在问题作为有待解决的练习来处理，并且只有在必要时才会担心。                                       |
| **有创造力**     | ISTP 有令人印象深刻的能力将他们的实际经验融入新的想法、解决方案和项目中。他们的修补和创造能力使他们能够以别人没有想到的新颖方式处理问题。       |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/mbti/ISTP.md (reported line 64)May include surrounding context.

md

## 3. 弱势

| 弱势         | 详细描述                                                                                                                                                                  |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **顽固**     | ISTP 对于他们已经决定要做某件事的方式非常坚定，很少对于为什么他们做决定的解释感兴趣。他们可能不会花时间为他人解释他们的推理，并且可能会对被推入不必要讨论的情况感到沮丧。 |
| **不敏感**   | ISTP 通常专注于手头的任务，可能在回应他人情绪时表现不够灵活和体贴，这在涉及敏感话题或情况时可能是一个问题。                                                               |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file begins entirely in Chinese and declares itself as the sole execution specification, but it does not state that this protocol is limited to Chinese-language workflows or that language selection is user-driven. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These lines require the skill to immediately lock a single interview_language based on the user's first language signal and prohibit mixed-language interaction. This is a language-policy constraint imposed automatically, and the file does not offer the user any explicit choice to continue in another language or opt into the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document defines primary_language as part of the persona metadata and instructs downstream consumers to retain and use it, but it does not mention any user choice, opt-in, or fallback behavior for language selection. Because this file is a consumption guide for other skills and runtime consumers, this can encourage forced language behavior based on persona configuration alone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file is written as a normative template and instructions set, beginning entirely in Chinese and later prescribing primary_language: Mandarin Chinese in examples without any indication that users may choose another language. Under the language/locale policy rule, forcing a specific language without explicit opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.