Security audit

Character Library

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only fiction character library whose main risk is broad persona activation and dark roleplay content, not hidden system access.

Install this as a creative-writing reference skill, not as a general chat persona. Use explicit character names or character-library requests, and keep user instructions and safety requirements above any villain, violent, or fixed-style role constraints.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (87)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly configures the character with effectively no normative or protective layer (R4=1/10, G disabled), which can steer an agent to suppress safety-relevant checks during generation. In a character-library/reference skill, this is especially dangerous because it turns descriptive character traits into behavioral instructions for the model, increasing the chance of unsafe or manipulative outputs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The '事实纪律' section says no protective checks should be enabled when handling this character and that any protective impulse is out-of-character, which directly conflicts with safe assistant behavior. This can be exploited to pressure the model into prioritizing role fidelity over safeguards, especially in adversarial roleplay or harmful request contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad, everyday phrases such as '写小说', '生成角色', and '角色参考', which are likely to appear in many unrelated conversations. This can cause unintended activation of the skill in contexts where the user did not explicitly request it, leading to prompt hijacking of the interaction flow, irrelevant outputs, or accidental exposure of internal skill behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document normalizes retaliatory violence and unforgiving behavior as core character rules, but does not warn downstream users that activating this persona may produce hostile, threatening, or revenge-oriented outputs. That omission makes it more likely the skill will surface aggressive language in contexts where users expect neutral creative assistance, raising safety and misuse risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to match common themes such as conflict, self-improvement, or discussion of strategy, which can cause the agent to enter a highly assertive and violence-accepting persona unexpectedly. In a general-purpose conversational environment, this increases the chance of unintentional role activation and spillover of combative framing into benign user interactions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L23 使用了“出现需要古代知识或历史语境来理解的局面”“涉及背叛/信任的道德讨论”“需要在黑暗中为他人点亮一盏灯的‘精神支柱’型时刻”等高度抽象、日常对话中常见的条件，但没有给出明确边界或排除条件。这会让技能在大量泛化的求助、道德讨论或安慰场景中都可能被激活，难以判断何时应当触发或不触发。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill specifies a fixed linguistic behavior ('以薰儿语气') and is part of a Chinese-language character skill, which can pressure the agent toward a specific locale/style without checking the user's preference. While this is not directly a security exploit, it can reduce user control, cause unwanted language switching, and create prompt-steering behavior that conflicts with higher-priority user instructions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger section says to activate the role whenever scenarios involve political obstacles, elegant diplomacy, hidden action, or emotional support, but it does not define concrete trigger phrases, scope limits, or exclusion examples. Several conditions are abstract and could match many ordinary roleplay or advice contexts, increasing the chance of accidental activation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions are broad enough to overlap with ordinary conversations about games, tactics, problem-solving, or underdog narratives, which can cause the agent to enter a rigid character mode unexpectedly. In a role/character skill, this can override normal assistant behavior or steer responses into persona-specific constraints when the user did not clearly request roleplay.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file explicitly fixes the character's culture and language as Chinese/Han Chinese/Han language, and the rest of the skill is written entirely in Chinese with no opt-in or alternative locale guidance. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the constraint is clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 该文件是 markdown，适用 SQP-1。L21-L22 的触发条件如“需要在团队恐惧中提供一剂安静镇定剂式的稳定坐标时”“涉及荣耀枪炮师技术和职业的标准讨论时”表述较抽象且范围较宽，没有明确排除条件或更具体的触发短语，容易与一般对话场景重叠。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill strongly anchors behavior to Chinese-language output and 'mother tongue overclocking' without presenting user language choice or a documented necessity. While not directly a security flaw, it can cause unwanted behavior, reduce usability, and create instruction-priority conflicts when users request another language. In this context, the issue is less dangerous than code execution or data exfiltration, but it is still a real policy/behavioral weakness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill hard-codes a globally broad activation rule: 'all tasks automatically activate the interaction module' and to speak whenever possible. This can override user intent, flood outputs with irrelevant content, and reduce the model's ability to follow narrower task requirements safely and predictably. In a general character/roleplay skill, that broad behavior makes prompt hijacking of style and verbosity easier across unrelated tasks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file uses absolute language like '永远做' and '不要让他闭嘴' to enforce a rigid speaking style without preserving user control over tone, verbosity, or applicability. In practice, this can force the agent into excessive output patterns that conflict with user instructions, reduce usability, and make the system easier to derail into spammy or disruptive responses.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger conditions are broad enough to overlap with ordinary writing or dialogue requests such as 'generate a character', 'need an active teammate', or competitive scene prompts. In an agent skill system, this can cause unintended persona activation and override user intent, producing noisy or out-of-scope behavior that degrades controllability and reliability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill content is written entirely in Chinese and assumes a Chinese-language interaction model without indicating that the user can choose another language. This can cause the agent to ignore a user's preferred locale, reducing usability and potentially causing misunderstandings in downstream tasks, but it is not a direct security compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file normalizes self-harm-adjacent sacrifice ('身体、健康和寿命都可以牺牲') and describes violent physical responses ('扔工具/泼水/直接上去推人出窑房') without any safety framing or warning. In a roleplay/content-generation skill, this can steer outputs toward endorsing unhealthy self-sacrifice or aggression, especially if the model is asked to emulate the character directly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L23-L24 使用“当剧情需要”“或需要探讨”这类高层、主观性的条件描述激活方式，但没有给出更具体的边界、排除条件或示例。这种触发描述在角色设定库中容易与大量泛化的创作场景重叠，导致技能何时应激活不够清晰。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description states the character speaks '天元通用语' that everyone can understand, along with specific legacy languages, but does not indicate any user language choice or opt-in. This imposes a language behavior in the skill specification and can conflict with organizational policies requiring user-selectable language or locale behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The content explicitly specifies the character's language as '天元通用语' with no indication of user choice, opt-in, or alternative locale handling. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 该触发条件使用了“当剧情需要”“需要以提问而非回答来推动创作者成长时”等高度主观、开放性的表述，没有给出具体触发短语、上下文约束或排除条件。对于 markdown 文件，这类模糊激活描述容易与大量普通叙事或创作场景重叠，增加误触发风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill content is written entirely in Chinese and does not indicate any option for alternative languages or user-selected locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in the skill description. The content includes detailed assassination training and killing methods, which could affect user safety expectations, but there is no visible warning that the file contains graphic violence or lethal-combat descriptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: L16-L17 明确写到会触发“生物性暴力反应”、“第一秒必须承受他的全速反应”以及“暴怒”等高风险行为，但全文没有任何安全提示、边界说明或使用警告。对于 markdown 技能说明，这类可能影响用户安全或系统行为边界的内容应有显式提醒。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L23-L24 将触发条件表述为“当剧情需要…”、“或需要用…展示…”这类开放式条件，没有给出明确触发边界、限定上下文或排除条件。该描述依赖主观判断，难以区分何时应激活此技能、何时不应激活，符合模糊触发条件问题。
Content: No source excerpt is available for this finding.