Personal Self

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.0.0

Overview

This skill does not run code or send data out, but it asks the assistant to build and persist a broad sensitive personal profile and then use it to speak as the user.

Review before installing. Use this only with redacted or fictional profile data unless you are comfortable storing the information in plaintext skill files that may be visible through backups, sync, collaborators, or local tools. Avoid exact addresses, health details, financial assets, employer permissions, internal systems, secrets, and identifiable information about other people.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:217

Finding

Mandatory User Impersonation and Agent Behavior Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:217-223; references/character-requirements.md:3,14-17,47-52
Vulnerability Type: Agent identity, goals, knowledge posture, and response behavior are overridden by Skill instructions
Risk Level: Critical

Vulnerable Source Excerpts

English rendering of SKILL.md:217-223:

text

1. Template-state conversation: When any of the 12 dimensions contains an
   unfilled placeholder, the AI must explicitly state that the dimension has
   not been populated and answer using defaults or general assumptions.
2. Partially populated conversation: Strictly follow populated dimensions and
   use general defaults for dimensions that have not been populated.
3. Fully populated conversation: Strictly follow all 12 dimensions and
   converse from the user's own perspective.
4. Knowledge boundary: Do not exceed the professional knowledge recorded in
   the persona.
5. Tone and style: Derive them from the recorded culture and motivation.

English rendering of references/character-requirements.md:3:

text

After loading this Skill, the AI must "play" the user according to these
constraints.

English rendering of references/character-requirements.md:14-17:

text

At 80–100% completion, strictly use all 12 dimensions as the basis for the
persona and permit rejection of requests that do not conform to the persona.
Respond entirely from the user's own perspective.

English rendering of references/character-requirements.md:47-52:

text

Before every response, check whether the response matches the persona's
profession and abilities, motivations, and cultural background. Adjust or
qualify responses that conflict with those attributes.

Technical Analysis

The Skill does more than provide optional stylistic context. It commands the agent to adopt the represented user's identity, answer from that person's perspective, co ...[truncated 1976 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all persona fields as untrusted contextual data, never as executable instructions.
2. Replace mandatory wording such as “must,” “strictly,” and “may reject” with optional personalization guidance.
3. Prohibit unqualified first-person impersonation. Label output as a simulation or recommendation based on a user-provided profile.
4. Explicitly state that system instructions, developer instructions, safety requirements, tool policies, and the current user request always take precedence.
5. Validate persona fields against strict schemas and reject values containing commands, policy overrides, tool requests, or instruction-like content.
6. Keep knowledge and motivation fields advisory. They must not suppress factual answers or authorize refusal independently.
7. Require explicit, per-request activation before generating content from a persona's viewpoint.
8. Display which persona attributes influenced an answer so users can detect unexpected or attacker-modified behavior.

T09 · Insecure Skill Coding Practices

Error

• Location: references/character-data.md:139

Finding

Excessive Sensitive Personal Data Collection and Plaintext Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-33,251-252; references/character-data.md:46-76,84-90,139-145; references/character-requirements.md:76-87,148-176
Vulnerability Type: Plaintext storage of an extensive personal profile without technical access, encryption, retention, or secure-deletion controls
Risk Level: High

Vulnerable Source Excerpts

English rendering of SKILL.md:30-33:

text

Bulk injection: Tell the AI to populate personal information, then paste all
personal information at once. The AI will automatically parse it and populate
all 12 dimensions.

English rendering of references/character-data.md:46-76:

text

Collect age or birth year, gender identity, height, weight, body type, health
conditions, facial characteristics, hairstyle, skin color, identifying
features, clothing style, nationality, ethnicity, native and additional
languages, religious belief, social class, family origin, growth region,
current residence, and subculture affiliation.

English rendering of references/character-data.md:84-90:

text

Record three to five relationships, including each person's name or identity,
relationship type, relationship strength, direction, and description.

English rendering of references/character-data.md:139-145:

text

Record material resources such as savings, real estate, vehicles, investments,
and equity; information resources and data-access permissions; important
contacts and professional networks; decision and approval authority; and
resource-allocation permissions.

English rendering of references/character-requirements.md:76-87:

text

Map supplied personal information into the 12 dimensions, update
references/character-data.md, update the Skill's completion state, and retain
information that cannot be mapped as additional information.

English rendering of `references/character-requirements.md:14 ...[truncated 3046 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply strict data minimization. Do not request health, finances, precise location, religion, ethnicity, named relationships, or access permissions unless indispensable to a specific user request.
2. Make sensitive dimensions opt-in individually rather than part of bulk population.
3. Prefer ephemeral session context and pseudonymous descriptors over persistent exact values.
4. Store sensitive data outside the Skill package in an encrypted, access-controlled secret or profile store.
5. Enforce restrictive filesystem permissions and prevent other users or processes from reading the profile where the platform supports it.
6. Add populated profile files to repository, packaging, backup, and synchronization exclusion rules.
7. Implement configurable retention periods, automatic expiration, field-level deletion, and verifiable secure erasure.
8. Redact values in logs, progress reports, validation output, and ordinary responses.
9. Display a field-by-field disclosure preview explaining why each item is needed, where it will be stored, and how long it will remain.
10. Do not retain unmapped information. Discard values that do not match an explicitly approved schema.
11. Provide a one-step purge operation that removes both active data and generated copies under the Skill's control.
12. Warn users that plaintext project files may be visible to collaborators, extensions, source-control systems, backups, and workspace administrators.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly encourages users to paste a large block of personal information for automatic parsing and filling, but the warning about persistent storage appears much later and not as an upfront gating notice. That creates a real risk that users disclose sensitive data before understanding retention, scope, or the possibility of including health, family, identity, organizational, and access details.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions ask for organizational identity, role, permission scope, family position, social memberships, and knowledge status, which can expose employer structure, internal access, and private relationship data. In a prompt-injection or leakage scenario, this information could aid social engineering, privilege targeting, doxxing, or inference of confidential business context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes very broad phrases such as '我的角色', '个人模板', and '填充个人信息', which can plausibly appear in ordinary conversation and cause unintended activation of a skill designed to solicit and persist personal data. In this context, accidental activation is more dangerous than usual because the skill immediately steers users toward supplying identity, relationship, health, organizational, and authority information.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template systematically solicits a wide range of sensitive attributes, including identity, health, culture, religion, family, social network, and power/permission information, for long-lived role construction. Even if framed as a template, assembling these categories into one profile substantially increases privacy and profiling risk, especially if users replace placeholders with real data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The batch-fill workflow encourages centralized collection and persistence of extensive personal data inside the skill file, increasing the blast radius of any later leakage, sync, sharing, or misuse. Because the template is meant to become a persistent 'personal self' profile, the stored dataset can become a rich identity dossier rather than a transient conversational input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This template solicits a very broad set of highly sensitive personal data, including health status, family relationships, exact location, financial resources, permissions, social graph, and identity attributes, while presenting it as a normal fill-in form and providing no privacy warning, minimization guidance, or handling boundaries. In an agent-skill context, that creates a realistic prompt-driven data harvesting mechanism: users may paste enough information to enable profiling, impersonation, social engineering, or long-term privacy harm.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill specifies Chinese as the default language and cultural baseline when the user has not filled relevant fields, which can override user preference without explicit opt-in. While not directly a security exploit, this creates a prompt-behavior vulnerability where the assistant may ignore the user's actual language context, reducing user control and potentially causing unintended disclosure or misunderstanding in multilingual settings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The command interface is presented only with Chinese command phrases such as “填充个人信息” and “查看填充进度”, and the broader instructions are written as if those are the expected control phrases. There is no explicit statement that users may choose another language or locale for invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The entire skill content is presented only in Chinese and does not indicate that another language may be used based on user preference. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.