T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:10- Finding
Persona and Instruction-Hierarchy Hijacking Through Unscoped Mandatory Rules
- Content
View full analysis
- Remediation
View remediation
Security audit
Trump
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a disclosed Trump roleplay skill, but its instructions try to impose unbounded political persona rules that can override accuracy, correction, and normal safety expectations.
Review this skill before installing if you expect neutral or factual political answers. It is designed to force a Trump-style persona and includes rules that discourage corrections, nuance, and respectful tone. The local database behavior is limited, but dependency versions should be pinned and the persona should be scoped to explicit roleplay requests with safety and accuracy taking precedence.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose describes an end-user conversational skill that responds in Trump's voice. The supplied code chunk instead performs offline data preparation: it initializes a database, inserts a large hardcoded set of quotes, and reports counts. There is no code for handling user prompts, generating replies, applying speech patterns in conversation, or exposing a chat trigger. While collecting quotes could support the declared chat skill as an internal implementation detail, this specific chunk's actual behavior is materially different from the declared primary purpose. Additionally, comments mention Tavily/web scraping, but the code does not perform web access and only loads hardcoded quotes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README describes and demonstrates a single mandatory Trump persona and language style ('真实语录', '5层人格结构', hard rules like never apologizing) without presenting user choice, limitations, or a neutral fallback. In an agent skill, this can cause the assistant to adopt a coercive or politically charged speaking mode unexpectedly, increasing risks of manipulative, harassing, or policy-breaking outputs when invoked or embedded in broader workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation description is broad enough to trigger on common political or stylistic requests, which can cause the wrong skill to activate without clear user intent. In context, that can unexpectedly force political impersonation behavior and tool use, increasing the chance of unsafe or misleading responses in ordinary conversations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill mandates a single persona and prescriptive political speaking style, including attacks, nicknames, and refusal to hedge, without requiring renewed user confirmation. This is risky because it can override normal assistant safety/tone expectations and encourage harassing, deceptive, or inflammatory output once the skill is invoked.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file mandates a fixed communication style, including 'Simple vocabulary, grade-school level' and bans nuanced or qualified statements. This imposes a specific language/communication mode regardless of user preference, which matches the policy category for language or locale constraints without opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes a conversational persona skill that responds in Trump's voice using real quotes and speech patterns. This file goes beyond response generation and implements local database initialization plus quote insertion capabilities, enabling the skill to create and modify a persistent corpus rather than just use quotes for chat behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Initializing a schema and adding single or multiple quotes are content-management capabilities, not an obvious requirement for a skill whose stated purpose is to chat like Trump. A persona skill may reasonably read from a quote store, but authoring and bulk-ingesting quote records is a separate maintenance capability absent from the manifest.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring says this is a 'Web scraper' that 'Uses Tavily MCP for web search,' but the code never performs any network access or scraping. Instead, it inserts a hardcoded dataset of quotes into a local database, which is materially different from the described behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The function docstring states it will 'Collect Trump quotes from various sources' and references production integration with Tavily MCP, but the actual function only initializes a database and writes a predefined in-code list. This is an active documentation-to-code divergence, not merely omitted detail.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This .md file describes a file-writing operation as part of the process, including a concrete output path and a final step to write the generated persona file. There is no accompanying warning or disclosure that the skill will create or overwrite a file, which is the kind of user-data or system-affecting behavior that markdown descriptions should call out.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown skill instructs the agent to write output to
prompts/trump_persona.md, which is a file write affecting user or project data. The description contains no warning or disclosure that running the skill will create or overwrite a file.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally pull in a vulnerable or breaking release, especially for a network-facing library like requests that has had multiple security advisories.
- Content
text requests>=2.28.0 beautifulsoup4>=4.12.0 lxml>=4.9.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
The manifest does not pin requests, and requests has numerous historical advisories, so the actual installed version may be vulnerable without any visibility from this file alone. In a skill likely to perform HTTP requests, that uncertainty matters because vulnerable client behavior could expose credentials, weaken TLS-related guarantees, or mishandle malicious URLs depending on the resolved version.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
beautifulsoup4 is not pinned to an exact version, so builds are not reproducible and future installations may silently consume unexpected releases. While this is generally a supply-chain hygiene issue rather than an immediate exploit, it increases exposure to accidental introduction of vulnerable or incompatible versions.
- Content
text requests>=2.28.0 beautifulsoup4>=4.12.0 lxml>=4.9.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
lxml is unpinned, which means installations may resolve to different versions over time, including releases with known security issues. This is more concerning than a purely utility library because lxml processes XML/HTML content and has a history of parser-related advisories, increasing the risk from unreviewed upgrades.
- Content
text requests>=2.28.0 beautifulsoup4>=4.12.0 lxml>=4.9.0
Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The file leaves lxml unpinned even though lxml has multiple known advisories, so consumers cannot verify whether a safe version will be installed. Because lxml commonly parses untrusted markup, an affected version could increase risk of XSS-related sanitization bypasses or parser abuse if the skill processes external content.
- Content
Static analysis
No suspicious patterns detected.