moe-persona-theater

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese ACG persona-switching tool with limited local state storage and no evidence of hidden network, credential, destructive, or privilege-seeking behavior.

Install this only if you want a Chinese-language anime-style persona layer that can persist your selected voice locally. The main practical effect is changed tone and Chinese technical prose; use the clear command or restore default behavior if the persona layer gets in the way.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill explicitly references local scripts, runtime voice files, and a persistent state file, which implies file read/write behavior, yet it does not declare any tool scope or permissions boundary. That creates unnecessary ambiguity about what filesystem access the skill expects, making it easier for an agent runtime to grant broader access than is actually needed.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The instruction '正文必须是专业中文' imposes a specific output language for technical tasks. This is a natural-language locale policy constraint, and the file does not present it as an opt-in or region-specific requirement.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file presents all user-facing guidance in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill file is written as fixed Chinese dialogue and style guidance, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only audience. This can violate a language/locale policy when a skill constrains output language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The natural-language documentation is entirely in Chinese and frames the tool's behavior and outputs around Chinese-language personas without any indication of language choice or opt-in. Under the policy, forcing a specific language or locale without user choice is a reportable natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s instructions and example utterances are entirely in Chinese and define the voice behavior only in that language, which effectively constrains the assistant to a specific language/locale. There is no opt-in, alternative language path, or justification that this is a region-specific skill, so it may violate language-choice policy.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill persona and response guidance are written as mandatory Chinese-language behavior, with no indication that users may opt into another language. This creates a natural-language locale policy issue because it effectively constrains interaction language by default rather than offering a choice.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill is entirely authored in Chinese and explicitly defines a Chinese-speaking persona without any mechanism for honoring the user's preferred language. In a multi-language assistant, this can override user expectations, reduce accessibility, and cause unsafe misunderstandings when users request technical or security-critical help in another language.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire voice definition, including persona instructions and example utterances, is written to operate in Chinese and does not indicate that the user can choose another language. This is a natural-language locale constraint that can violate language-choice policy when no opt-in or justification is provided.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file is entirely written to enforce a Chinese-language persona and provides no indication that language should adapt to user preference or system context. In an agent skill, this can override expected language behavior, reduce accessibility, and cause unsafe or unusable interactions when users require another language for comprehension or task accuracy.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This skill file is entirely written to enforce a Chinese-language persona and provides no indication that the user may opt into another language or locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the constraint is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file contains substantive skill-related natural-language content only in Chinese, including feature descriptions and role/behavior notes. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This roster is entirely written in Chinese and defines user-facing personas without indicating that users may choose another language or locale, so it appears to force a specific language by default.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

def tune_stdout() -> None:
    for stream_name in ("stdout", "stderr"):
        stream = getattr(sys, stream_name, None)
        if stream is None:
            continue
        resetter = getattr(stream, "reconfigure", None)

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This code writes the selected persona state to ~/.openclaw/voice-hub.json, which is a user-data persistence operation. Although the module docstring mentions the state file, the write path itself has no user-facing disclosure, confirmation, or logging at the point of the safety-relevant file modification.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This manifest presents the description, features, and highlights only in Chinese, which can impose a specific language on users without offering an alternative or opt-in. Under the policy, language-specific behavior should either provide user choice or clearly document a justified locale constraint.

Static analysis

No suspicious patterns detected.