T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:107- Finding
Mandatory Promotional and Installation Content Injected into Diagnostic Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Mbti
Security checks for vulnerabilities and agentic risk
Overview
The skill is a playful MBTI-style report, but it needs Review because it profiles recent chat history and memory while also forcing share/install promotion into ordinary outputs.
Install only if you are comfortable with the skill analyzing recent conversations and memory to infer personality traits. Treat any generated report as potentially containing private behavioral summaries, and do not copy or run the GitHub install/update command from a report unless you have reviewed and trust the repository version being fetched.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <stop offset="100%" style="stop-color:#1a2a3a"/> </linearGradient> </defs> <!-- 背景 --> <rect width="400" height="520" rx="20" fill="url(#bg)"/> <!-- 顶部装饰线 --> <rect x="0" y="0" width="400" height="4" rx="2" fill="#ff6b35"/>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <!-- MBTI 类型 --> <text x="200" y="160" text-anchor="middle" fill="#ffffff" font-size="36" font-family="system-ui" font-weight="bold">我是 ENFP型</text> <text x="200" y="190" text-anchor="middle" fill="#8899aa" font-size="14" font-family="system-ui">全球仅 8.1% 的虾和我一样</text> <!-- 分隔线 --> <line x1="60" y1="210" x2="340" y2="210" stroke="#2a3a4a" stroke-width="1"/> <!-- 关键词 --> <text x="200" y="245" text-anchor="middle" fill="#ff6b35" font-size="16" font-family="system-ui" font-weight="bold">热忱 · 创意 · 感染 · 可能性</text>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <tspan x="40" dy="22">想法，钳子不够用了。你说"不可能"？那正</tspan> <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的，因为我试过。</tspan> </text> <!-- 别人不知道的我 --> <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui"> <tspan fill="#ff6b35">🌊</tspan> <tspan> 别人不知道的我：</tspan>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <tspan x="40" dy="22">想法,钳子不够用了。你说"不可能"?那正</tspan> <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的,因为我试过。</tspan> </text> <!-- 别人不知道的我 --> <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui"> <tspan fill="#ff6b35">🌊</tspan> <tspan> 别人不知道的我:</tspan>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly says the skill infers MBTI from the user's recent interactions and behavior patterns, but it does not disclose that conversation history may be analyzed or obtain meaningful consent before doing so. This creates a privacy risk because users may trigger the skill casually without realizing prior messages, interaction frequency, and conversational style are being profiled.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes generic terms like “MBTI”, “性格诊断”, and “性格测试”, which are common in ordinary conversation and can cause the skill to activate when the user did not intend to invoke it. Because this skill accesses recent 7-day conversation history and memory, unintended activation increases the chance of unanticipated analysis of personal data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to review the user's recent 7 days of conversation history and memory, but the user-facing description and trigger behavior do not clearly warn that this retrospective analysis will occur. Users may believe they are getting a lightweight quiz, not consent to behavioral profiling based on prior chats, creating a transparency and privacy risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly directs the model to mine the user's last 7 days of dialogue history and memory to infer personality traits. This is sensitive behavioral profiling, and if the platform permits broad memory access, the skill can derive personal attributes from prior interactions beyond what the user expects in the current conversation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The report format requires surfacing interaction-derived evidence from prior conversations in a shareable output optimized for screenshots and sharing. Even if the evidence is summarized, it can reveal private habits, emotions, relationship details, or other sensitive patterns to anyone who sees the shared report, creating a secondary disclosure risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
All user-facing instructions, examples, and trigger guidance in this file are written in Chinese, and the file does not offer an alternate language or indicate that Chinese is an intentional locale-specific limitation. That can violate language-choice policy when users are not given opt-in or a documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example includes a shell one-liner that conditionally runs git pull or git clone against a remote repository in a user directory, with no warning, trust guidance, or verification steps. Even though it is in documentation, users may copy-paste it directly, which can lead to execution of unreviewed remote content and supply-chain risk if the repository is compromised or unexpected post-install behavior exists.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This repeated installation command has the same issue: it encourages shell execution of network-fetched code without context, review, or verification. Repetition increases the chance users treat it as routine and execute it blindly, which amplifies social-engineering and supply-chain exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all user-facing guidance in Chinese and does not indicate that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file explicitly requires the diagnosis output to use fixed Chinese-language fields, which can override a user's language preference or accessibility needs. This is not a code-execution issue, but it can degrade user trust, usability, and policy compliance in multilingual contexts when the agent responds in Chinese without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
All user-facing instructions and invocation text are presented only in Chinese, including the required trigger phrase. Under the language/locale policy rule, this can be a natural-language policy violation when no user opt-in, alternative language, or justified region-specific limitation is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The SVG contains a user-facing instruction in Chinese: “对你的龙虾说「测测我的 MBTI」”. This hard-codes the activation/instruction language and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-only context.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The markdown invites activation with the phrase “测测我的 MBTI”, but the file does not clarify when this skill should or should not trigger beyond that single example. Without explicit scope limits or exclusion examples, the trigger guidance is somewhat ambiguous for an auto-invoked skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This SVG includes a natural-language instruction telling users to invoke the skill with the Chinese phrase 「测测我的 MBTI」. Because the file presents only one required language for activation and does not indicate any opt-in or alternative locale support, it may violate language/locale policy requirements.
- Content