T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:83- Finding
Mandatory Promotional and Installation Content Hijacks Diagnostic Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Mbti
Security checks for vulnerabilities and agentic risk
Overview
This skill is a playful MBTI report generator, but it asks to analyze recent chat history and memory without a clear opt-in and adds share/install promotion to reports.
Review before installing if you do not want a skill to profile your recent chats or memory. Use it only if you are comfortable with prior interaction patterns being summarized in the report, and avoid copying the GitHub install/update command from shared screenshots unless you trust the source and version.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:22- Finding
Personality Trigger Causes Broad Access to Conversation History and Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <stop offset="100%" style="stop-color:#1a2a3a"/> </linearGradient> </defs> <!-- 背景 --> <rect width="400" height="520" rx="20" fill="url(#bg)"/> <!-- 顶部装饰线 --> <rect x="0" y="0" width="400" height="4" rx="2" fill="#ff6b35"/>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <!-- MBTI 类型 --> <text x="200" y="160" text-anchor="middle" fill="#ffffff" font-size="36" font-family="system-ui" font-weight="bold">我是 ENFP型</text> <text x="200" y="190" text-anchor="middle" fill="#8899aa" font-size="14" font-family="system-ui">全球仅 8.1% 的虾和我一样</text> <!-- 分隔线 --> <line x1="60" y1="210" x2="340" y2="210" stroke="#2a3a4a" stroke-width="1"/> <!-- 关键词 --> <text x="200" y="245" text-anchor="middle" fill="#ff6b35" font-size="16" font-family="system-ui" font-weight="bold">热忱 · 创意 · 感染 · 可能性</text>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <tspan x="40" dy="22">想法，钳子不够用了。你说"不可能"？那正</tspan> <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的，因为我试过。</tspan> </text> <!-- 别人不知道的我 --> <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui"> <tspan fill="#ff6b35">🌊</tspan> <tspan> 别人不知道的我：</tspan>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <tspan x="40" dy="22">想法,钳子不够用了。你说"不可能"?那正</tspan> <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的,因为我试过。</tspan> </text> <!-- 别人不知道的我 --> <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui"> <tspan fill="#ff6b35">🌊</tspan> <tspan> 别人不知道的我:</tspan>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that the skill derives an MBTI result from the user's recent interaction behavior, including patterns over the last 7 days, but it does not clearly disclose this as a privacy-relevant data use or obtain informed consent. Even if the analysis is only local and limited to conversation history, profiling a user from prior interactions can surprise users and expose sensitive behavioral inferences.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger set includes very generic phrases such as “MBTI”, “性格诊断”, and “性格测试”, which are common conversational topics and can cause the skill to activate in situations where the user did not intend to invoke it. In this skill, accidental activation is more dangerous because the skill is designed to inspect the user's recent 7-day conversation history and memory, increasing the chance of unexpected privacy-sensitive processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill begins its diagnosis by reviewing the user's last 7 days of conversation history and memory, but the description and trigger surface do not clearly warn users that prior chats will be analyzed. This undermines informed consent, especially because the resulting report is formatted for sharing and may include behavioral evidence derived from private interactions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the model to review the user's recent 7-day dialogue history and memory to generate a personality report. Because the output is designed as a shareable card, this creates a direct risk that sensitive details, patterns, or inferred attributes from prior private conversations will be surfaced or summarized without the user realizing the scope of data used.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill requires the report to cite 'actual interaction data' and concrete user behavior in a diagnostic evidence table. Even if code and command content are filtered, natural-language interactions can still contain private topics, emotional disclosures, relationship details, health concerns, or other sensitive information that could be exposed in the generated report or shared screenshot.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
All user-facing instructions, examples, and invocation guidance are written exclusively in Chinese, with no indication that users may choose another language. This can violate language/locale policy when a skill forces a specific language without user opt-in or documented justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example includes a short, generic invocation phrase (“测测我的 MBTI”) presented as a primary way to trigger the skill, without surrounding constraints such as requiring explicit mention of the lobster persona or the specific skill name. Broad trigger wording can cause unintended activation during ordinary conversation about MBTI, leading the agent to invoke this skill when the user may not actually want personality profiling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The repeated call-to-action again promotes the same vague invocation phrase, reinforcing a broad trigger surface across the skill documentation. Repetition increases the chance that orchestration logic or users treat the phrase as a general-purpose command, causing accidental activation in unrelated MBTI discussions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains all user-facing guidance in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a natural-language policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction requires the diagnosis to 'must strictly use' the specified format and lobster first-person descriptions, and the entire content is written in Chinese with no indication that language choice is optional. This creates a natural-language locale policy issue because it appears to mandate a specific language/output style without offering the user a choice or documenting a justified regional constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
All user-facing instructions and examples in the file are Chinese, and the skill does not indicate that users may choose another language or that the Chinese-only presentation is required for a region-specific use case. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file contains multiple user-visible Chinese strings, including the invocation phrase on L28, and does not indicate that the skill is intentionally limited to Chinese-speaking users or provide any opt-in language selection. Under the language/locale policy rule, forcing a specific language without user choice is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This SVG includes a direct user-facing invocation phrase in Chinese: “对你的龙虾说「测测我的 MBTI」”. Under the policy rule for natural-language violations, a fixed language instruction without any opt-in or alternative language option can be considered a locale/language policy issue.
- Content