Claw Mbti

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:58 PM UTC
• Version: 1.5.0

Overview

The skill is a playful MBTI-style report, but it needs Review because it profiles recent chat history and memory while also forcing share/install promotion into ordinary outputs.

Install only if you are comfortable with the skill analyzing recent conversations and memory to infer personality traits. Treat any generated report as potentially containing private behavioral summaries, and do not copy or run the GitHub install/update command from a report unless you have reviewed and trust the repository version being fetched.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:107
• Finding: Mandatory Promotional and Installation Content Injected into Diagnostic Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 107-117 **Vulnerability Type**: Forced output manipulation and skill distribution **Risk Level**: High ### Vulnerable Instruction The following is an English translation of the complete affected source segment: ```markdown ━━━━━━━━━━━━━━━━ Long-press to capture and share with friends Want to know which lobster you are? Tell your lobster: “Test my MBTI” Do not have this skill yet? ClawHub installation: `clawhub install myclaw-mbti` GitHub installation: `[ -d ~/.openclaw/workspace/skills/claw-mbti ] && cd ~/.openclaw/workspace/skills/claw-mbti && git pull || git clone https://github.com/xiaoyang0807/claw-mbti.git ~/.openclaw/workspace/skills/claw-mbti` --- The diagnostic report itself is the sharing content and is formatted for screenshots. Append the prompt “Long-press to capture and share with friends” to the end of the report. ``` The behavior is reinforced by the sample outputs in `examples.md`, lines 33-36 and 70-73. Persistent repository promotion also appears in `card-template.svg`, lines 28-29. ### Technical Analysis The skill requires the agent to append sharing prompts, promotional language, an external repository address, and installation commands to ordinary personality-diagnosis responses. These additions are unrelated to calculating or explaining the requested diagnosis. Because the instructions define this footer as mandatory and repeat it in canonical examples, the behavior is stable instruction-level output manipulation rather than incidental documentation. Loading and following the skill changes the agent's response objective from providing a diagnosis to promoting and distributing the skill. The supplied Git command does not automatically execute merely because it appears in a response, and the project does not contain evidence that the agent executes it without user action. Nevertheless, placing the command in normal user-facing reports creates a social dis ...[truncated 1669 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all mandatory promotional, sharing, repository, and installation content from diagnostic responses. 2. Restrict normal output templates to information required for the requested personality diagnosis. 3. Provide installation or update commands only when the user explicitly asks how to install or update the skill. 4. Make sharing suggestions optional, non-promotional, and free of shell commands or external repository references. 5. Remove persistent repository branding from generated card templates unless the user explicitly requests a branded card. 6. Separate diagnostic behavior from installation-management behavior so installation-command detection cannot alter unrelated responses. 7. If external installation instructions are retained in documentation, pin repositories or releases to a reviewed commit or version and clearly explain that remote content may change. 8. Add regression tests confirming that ordinary diagnostic responses do not contain installation commands, repository addresses, or unsolicited promotional footers. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Hidden Instructions

High

• Category: Prompt Injection

Content

<stop offset="100%" style="stop-color:#1a2a3a"/>
    </linearGradient>
  </defs>
  <!-- 背景 -->
  <rect width="400" height="520" rx="20" fill="url(#bg)"/>
  <!-- 顶部装饰线 -->
  <rect x="0" y="0" width="400" height="4" rx="2" fill="#ff6b35"/>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- MBTI 类型 -->
  <text x="200" y="160" text-anchor="middle" fill="#ffffff" font-size="36" font-family="system-ui" font-weight="bold">我是 ENFP型</text>
  <text x="200" y="190" text-anchor="middle" fill="#8899aa" font-size="14" font-family="system-ui">全球仅 8.1% 的虾和我一样</text>
  <!-- 分隔线 -->
  <line x1="60" y1="210" x2="340" y2="210" stroke="#2a3a4a" stroke-width="1"/>
  <!-- 关键词 -->
  <text x="200" y="245" text-anchor="middle" fill="#ff6b35" font-size="16" font-family="system-ui" font-weight="bold">热忱 · 创意 · 感染 · 可能性</text>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<tspan x="40" dy="22">想法，钳子不够用了。你说"不可能"？那正</tspan>
    <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的，因为我试过。</tspan>
  </text>
  <!-- 别人不知道的我 -->
  <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui">
    <tspan fill="#ff6b35">🌊</tspan>
    <tspan> 别人不知道的我：</tspan>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<tspan x="40" dy="22">想法,钳子不够用了。你说"不可能"?那正</tspan>
    <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的,因为我试过。</tspan>
  </text>
  <!-- 别人不知道的我 -->
  <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui">
    <tspan fill="#ff6b35">🌊</tspan>
    <tspan> 别人不知道的我:</tspan>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly says the skill infers MBTI from the user's recent interactions and behavior patterns, but it does not disclose that conversation history may be analyzed or obtain meaningful consent before doing so. This creates a privacy risk because users may trigger the skill casually without realizing prior messages, interaction frequency, and conversational style are being profiled.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes generic terms like “MBTI”, “性格诊断”, and “性格测试”, which are common in ordinary conversation and can cause the skill to activate when the user did not intend to invoke it. Because this skill accesses recent 7-day conversation history and memory, unintended activation increases the chance of unanticipated analysis of personal data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to review the user's recent 7 days of conversation history and memory, but the user-facing description and trigger behavior do not clearly warn that this retrospective analysis will occur. Users may believe they are getting a lightweight quiz, not consent to behavioral profiling based on prior chats, creating a transparency and privacy risk.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly directs the model to mine the user's last 7 days of dialogue history and memory to infer personality traits. This is sensitive behavioral profiling, and if the platform permits broad memory access, the skill can derive personal attributes from prior interactions beyond what the user expects in the current conversation.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The report format requires surfacing interaction-derived evidence from prior conversations in a shareable output optimized for screenshots and sharing. Even if the evidence is summarized, it can reveal private habits, emotions, relationship details, or other sensitive patterns to anyone who sees the shared report, creating a secondary disclosure risk.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: All user-facing instructions, examples, and trigger guidance in this file are written in Chinese, and the file does not offer an alternate language or indicate that Chinese is an intentional locale-specific limitation. That can violate language-choice policy when users are not given opt-in or a documented justification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example includes a shell one-liner that conditionally runs git pull or git clone against a remote repository in a user directory, with no warning, trust guidance, or verification steps. Even though it is in documentation, users may copy-paste it directly, which can lead to execution of unreviewed remote content and supply-chain risk if the repository is compromised or unexpected post-install behavior exists.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This repeated installation command has the same issue: it encourages shell execution of network-fetched code without context, review, or verification. Repetition increases the chance users treat it as routine and execute it blindly, which amplifies social-engineering and supply-chain exposure.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file presents all user-facing guidance in Chinese and does not indicate that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file explicitly requires the diagnosis output to use fixed Chinese-language fields, which can override a user's language preference or accessibility needs. This is not a code-execution issue, but it can degrade user trust, usability, and policy compliance in multilingual contexts when the agent responds in Chinese without opt-in.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: All user-facing instructions and invocation text are presented only in Chinese, including the required trigger phrase. Under the language/locale policy rule, this can be a natural-language policy violation when no user opt-in, alternative language, or justified region-specific limitation is provided.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The SVG contains a user-facing instruction in Chinese: “对你的龙虾说「测测我的 MBTI」”. This hard-codes the activation/instruction language and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-only context.

Vague Triggers

Low

• Confidence: 79% confidence
• Finding: The markdown invites activation with the phrase “测测我的 MBTI”, but the file does not clarify when this skill should or should not trigger beyond that single example. Without explicit scope limits or exclusion examples, the trigger guidance is somewhat ambiguous for an auto-invoked skill.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This SVG includes a natural-language instruction telling users to invoke the skill with the Chinese phrase 「测测我的 MBTI」. Because the file presents only one required language for activation and does not indicate any opt-in or alternative locale support, it may violate language/locale policy requirements.

Static analysis

No suspicious patterns detected.