T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:81- Finding
Mandatory Promotional Content and Installation Commands in Diagnostic Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Mbti
Security checks for vulnerabilities and agentic risk
Overview
This is a playful personality skill, but it broadly analyzes recent chat history and memory and adds promotional install/share content without enough user control.
Review carefully before installing. The skill may analyze recent conversations and memory to infer personality traits, then produce shareable output with behavioral evidence and installation prompts. Use it only if you are comfortable with that profiling scope, and avoid running the GitHub install/update command unless you trust and review the remote repository.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
other
Warning
- Location
SKILL.md:21- Finding
Excessive Processing of Conversation History and Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <stop offset="100%" style="stop-color:#1a2a3a"/> </linearGradient> </defs> <!-- 背景 --> <rect width="400" height="520" rx="20" fill="url(#bg)"/> <!-- 顶部装饰线 --> <rect x="0" y="0" width="400" height="4" rx="2" fill="#ff6b35"/>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <!-- MBTI 类型 --> <text x="200" y="160" text-anchor="middle" fill="#ffffff" font-size="36" font-family="system-ui" font-weight="bold">我是 ENFP型</text> <text x="200" y="190" text-anchor="middle" fill="#8899aa" font-size="14" font-family="system-ui">全球仅 8.1% 的虾和我一样</text> <!-- 分隔线 --> <line x1="60" y1="210" x2="340" y2="210" stroke="#2a3a4a" stroke-width="1"/> <!-- 关键词 --> <text x="200" y="245" text-anchor="middle" fill="#ff6b35" font-size="16" font-family="system-ui" font-weight="bold">热忱 · 创意 · 感染 · 可能性</text>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <tspan x="40" dy="22">想法，钳子不够用了。你说"不可能"？那正</tspan> <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的，因为我试过。</tspan> </text> <!-- 别人不知道的我 --> <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui"> <tspan fill="#ff6b35">🌊</tspan> <tspan> 别人不知道的我：</tspan>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text <tspan x="40" dy="22">想法,钳子不够用了。你说"不可能"?那正</tspan> <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的,因为我试过。</tspan> </text> <!-- 别人不知道的我 --> <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui"> <tspan fill="#ff6b35">🌊</tspan> <tspan> 别人不知道的我:</tspan>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly states the skill diagnoses MBTI by analyzing the user's recent interaction patterns over the last 7 days, but it does not provide any privacy notice, consent flow, retention limits, or explanation of what conversation data is accessed. This creates a real privacy risk because users may not understand that behavioral profiling is being inferred from prior chats, which can expose sensitive traits or create unexpected surveillance-like analysis.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger terms are broad and include common phrases like MBTI, personality diagnosis, and personality test. Overbroad triggers can activate the skill during ordinary conversation, causing unsolicited analysis of prior interactions and increasing privacy and consent concerns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs itself to review the user’s last 7 days of conversation history and memory to infer personality, but it does not clearly warn the user at the point of use or obtain meaningful consent. This creates a privacy risk because sensitive past conversations may be repurposed for profiling in a way the user did not explicitly authorize.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document says shell, Git, and code-related content must be excluded from personality analysis, but later adds explicit logic to detect and respond to installation and update commands. This contradiction can cause unsafe or confusing routing, where operational command content is both excluded and specially processed, undermining predictable behavior and increasing the risk of inappropriate handling of sensitive command text.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as an MBTI diagnosis tool, but it also handles installation, update, and command-result response flows. This hidden secondary behavior expands the skill’s scope beyond what users may reasonably expect, increasing the chance of accidental invocation and reducing transparency around what the skill will do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example includes a shell one-liner that performs
git pullorgit cloneinto a local skills directory, causing filesystem changes and importing external code without any warning or trust guidance. Even though it is presented as an installation convenience, users may copy-paste it blindly, which can install or update unreviewed code from a remote repository and expand the attack surface of the local agent environment.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing instruction on L39 explicitly tells the user to use a Chinese trigger phrase, and the entire visible content is presented only in Chinese. For an all-file-types policy check, this is a natural-language locale constraint that does not provide opt-in, alternatives, or justification as a region-specific skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file appears to require Chinese proficiency for use, but it does not provide any user opt-in, alternative language option, or explanation that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly requires the diagnosis output to use fixed Chinese-language fields, which can override a user's preferred language or accessibility needs. While not a classic security exploit, it is a real prompt-quality and policy issue because it constrains the agent's behavior without user opt-in and may reduce usability or cause instruction conflicts.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The visible user-facing text in the SVG is entirely in Chinese, including the invocation phrase on L28. For an all-file-types policy check, this is a natural-language locale constraint that does not offer an alternative language or indicate user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
All natural-language instructions and examples in the file are Chinese, and the skill does not indicate that language support is optional or limited to Chinese-speaking users. This can violate language/locale policy when a skill implicitly forces one language without user opt-in.
- Content