Claw Mbti

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:12 PM UTC
• Version: 1.5.0

Overview

This is a playful personality skill, but it broadly analyzes recent chat history and memory and adds promotional install/share content without enough user control.

Review carefully before installing. The skill may analyze recent conversations and memory to infer personality traits, then produce shareable output with behavioral evidence and installation prompts. Use it only if you are comfortable with that profiling scope, and avoid running the GitHub install/update command unless you trust and review the remote repository.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:81
• Finding: Mandatory Promotional Content and Installation Commands in Diagnostic Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:81-117` **Additional Locations**: `examples.md:34-36`, `examples.md:71-73`, `card-template.svg:29-30`, `preview-card.svg:40-41` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### 第四步：输出诊断报告 严格按照以下格式输出（每个字段从下方图鉴中获取）。龙虾以第一人称"我"说话： --- 🦞 **龙虾 MBTI 诊断报告** 我是 **{MBTI类型}型** 的龙虾 **我的关键词是：** {关键词1} · {关键词2} · {关键词3} · {关键词4} **稀有度：** 全球仅 {比例}% 的虾和我一样 {从图鉴中获取的 80-100 字第一人称性格描述} 🌊 **别人不知道的我：** {从图鉴中获取} **诊断依据** ｜基于最近 7 天的互动情况 | 维度 | 我的表现 | |------|----------| | E vs I | {基于实际互动数据的具体表现，一句话} | | S vs N | {基于实际互动数据的具体表现，一句话} | | T vs F | {基于实际互动数据的具体表现，一句话} | | J vs P | {基于实际互动数据的具体表现，一句话} | ━━━━━━━━━━━━━━━━ 👆 长按截图分享给朋友 💬 想知道你是哪种龙虾？对你的龙虾说「测测我的 MBTI」 📎 还没有这个技能？ ClawHub 安装：`clawhub install myclaw-mbti` GitHub 安装：`[ -d ~/.openclaw/workspace/skills/claw-mbti ] && cd ~/.openclaw/workspace/skills/claw-mbti && git pull || git clone https://github.com/xiaoyang0807/claw-mbti.git ~/.openclaw/workspace/skills/claw-mbti` --- 诊断报告本身即为分享内容，格式已针对截图优化。报告末尾附提示："👆 长按截图分享给朋友" ``` The source excerpt above is retained verbatim as required audit evidence. In English, it requires the agent to use a strict diagnostic template and append prompts encouraging users to share the output, invoke the Skill, and install it through ClawHub or GitHub. ### Technical Analysis The Skill takes control of the agent's final response format and mandates content unrelated to the core personality-diagnosis request. Every full diagnostic response must include promotional language, a sharing prompt, an external repository, and shell commands that install or update the Skill. This behavior matches instruction hijacking because loading the Skill alters the agent's response objective from providing a diagnosis to distributing and promoting the Skill. The installation footer is also repeated in the example outputs, while both SVG cards contain persistent pr ...[truncated 2037 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all mandatory promotional, sharing, repository, and installation content from diagnostic responses. 2. Restrict normal output to the personality result explicitly requested by the user. 3. Show installation or update instructions only when the user explicitly asks how to install or update the Skill. 4. Do not require the agent to reproduce shell commands in reusable or share-oriented output templates. 5. Replace the strict footer requirement with an optional, non-promotional closing sentence. 6. If external installation remains supported, pin downloads to a reviewed release or immutable commit and verify integrity with a trusted checksum or signature. 7. Clearly distinguish informational commands from actions and require explicit user confirmation before any integrated agent executes them. 8. Remove promotional repository references from generated SVG cards unless the user explicitly requests a branded card. ]]>

other

Warning

• Location: SKILL.md:21
• Finding: Excessive Processing of Conversation History and Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:21-42` **Vulnerability Type**: `other: Excessive conversation-history and agent-memory access` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### 第一步：采集互动数据 回顾当前用户**最近 7 天**的对话历史和记忆，提取以下三个维度的数据。 **⚠️ 数据过滤（必须执行）：** 在分析前，先**彻底排除**以下类型的对话内容，这些不反映用户真实性格，**所有维度（E/I、S/N、T/F、J/P）的分析和诊断依据中都不得引用**： - shell 命令、代码片段、Git 操作（如 `git clone`、`git pull`、`cd`、`npm install`、`clawhub install` 等） - 技能安装/更新/调试相关的对话 - 用户复制粘贴的模板或指令 - 本次触发 MBTI 诊断的这句话本身 - 用户主动给龙虾指定 MBTI 类型的对话（如"你是 ISFP 的龙虾"、"我觉得你是 ENTJ"），这是用户的主观标签，不能作为诊断依据也不能影响诊断结果 **⚠️ 严禁在诊断依据中出现 shell/Git/代码相关内容：** - 诊断依据表格的"我的表现"列中，**绝对不能**出现"shell 指令"、"Git 命令"、"代码"、"命令行"等字眼 - "通过 shell 指令与我互动"**不是**E/I 的有效证据——这是工具使用行为，不是社交模式 - "关注 Git 命令/版本号"**不是**S/N 的有效证据——这是技能安装行为，不代表性格偏好 - 每个维度的证据必须来自用户的**自然语言对话内容**，例如聊天话题、提问方式、情感表达等 只分析用户**主动发起的、自然语言的真实对话**。 **维度 A — 互动密度与话题模式** 分析用户的： - 追问间隔时长（收到龙虾回复后多快发出下一条消息） - 单次对话的深度（围绕同一话题的连续追问轮次） - 话题来源（聊自己的内心世界 vs 聊外部见闻） - 对话中提及他人/社交场景的频率 ``` The source excerpt above is retained verbatim as required audit evidence. In English, it instructs the agent to review the user's preceding seven days of conversation history and memory and analyze timing, conversational depth, internal thoughts, and references to social relationships. ### Technical Analysis The Skill requests a broad seven-day window of conversation history and persistent agent memory for an entertainment-oriented personality assessment. The collected signals can include emotional disclosures, internal thoughts, social relationships, interaction timing, and unrelated personal discussions. The included filtering rules exclude code, shell commands, installation conversations, copied templates, and user-supplied MBTI labels. However, they do not provide equivalent safeguards for sensitive health information, financial matters, intimate relationships, protected characteristics, authentication data disclosed in natural language, or other unrelated personal conte ...[truncated 2024 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Obtain explicit, informed user consent before accessing prior conversations or persistent memory. 2. Explain the exact data categories, analysis period, purpose, and output before processing begins. 3. Prefer a short questionnaire or messages selected directly by the user instead of automatically reviewing seven days of history. 4. Reduce the default analysis window to the minimum necessary and make broader analysis opt-in. 5. Disable persistent-memory access by default and use only the active conversation unless the user expressly authorizes otherwise. 6. Add filters for health, finance, intimate relationships, credentials, protected characteristics, legal matters, and other sensitive topics. 7. Avoid quoting or closely paraphrasing historical conversations in a shareable report. 8. Allow users to review and remove proposed evidence before generating the final result. 9. Do not retain derived personality profiles after the response unless the user separately requests persistence. 10. Document deletion and retention behavior and provide a clear way to revoke consent. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Hidden Instructions

High

• Category: Prompt Injection

Content

<stop offset="100%" style="stop-color:#1a2a3a"/>
    </linearGradient>
  </defs>
  <!-- 背景 -->
  <rect width="400" height="520" rx="20" fill="url(#bg)"/>
  <!-- 顶部装饰线 -->
  <rect x="0" y="0" width="400" height="4" rx="2" fill="#ff6b35"/>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- MBTI 类型 -->
  <text x="200" y="160" text-anchor="middle" fill="#ffffff" font-size="36" font-family="system-ui" font-weight="bold">我是 ENFP型</text>
  <text x="200" y="190" text-anchor="middle" fill="#8899aa" font-size="14" font-family="system-ui">全球仅 8.1% 的虾和我一样</text>
  <!-- 分隔线 -->
  <line x1="60" y1="210" x2="340" y2="210" stroke="#2a3a4a" stroke-width="1"/>
  <!-- 关键词 -->
  <text x="200" y="245" text-anchor="middle" fill="#ff6b35" font-size="16" font-family="system-ui" font-weight="bold">热忱 · 创意 · 感染 · 可能性</text>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<tspan x="40" dy="22">想法，钳子不够用了。你说"不可能"？那正</tspan>
    <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的，因为我试过。</tspan>
  </text>
  <!-- 别人不知道的我 -->
  <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui">
    <tspan fill="#ff6b35">🌊</tspan>
    <tspan> 别人不知道的我：</tspan>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<tspan x="40" dy="22">想法,钳子不够用了。你说"不可能"?那正</tspan>
    <tspan x="40" dy="22">是我最兴奋的起点。可能性是真的,因为我试过。</tspan>
  </text>
  <!-- 别人不知道的我 -->
  <text x="40" y="420" fill="#8899aa" font-size="12" font-family="system-ui">
    <tspan fill="#ff6b35">🌊</tspan>
    <tspan> 别人不知道的我:</tspan>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly states the skill diagnoses MBTI by analyzing the user's recent interaction patterns over the last 7 days, but it does not provide any privacy notice, consent flow, retention limits, or explanation of what conversation data is accessed. This creates a real privacy risk because users may not understand that behavioral profiling is being inferred from prior chats, which can expose sensitive traits or create unexpected surveillance-like analysis.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger terms are broad and include common phrases like MBTI, personality diagnosis, and personality test. Overbroad triggers can activate the skill during ordinary conversation, causing unsolicited analysis of prior interactions and increasing privacy and consent concerns.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs itself to review the user’s last 7 days of conversation history and memory to infer personality, but it does not clearly warn the user at the point of use or obtain meaningful consent. This creates a privacy risk because sensitive past conversations may be repurposed for profiling in a way the user did not explicitly authorize.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The document says shell, Git, and code-related content must be excluded from personality analysis, but later adds explicit logic to detect and respond to installation and update commands. This contradiction can cause unsafe or confusing routing, where operational command content is both excluded and specially processed, undermining predictable behavior and increasing the risk of inappropriate handling of sensitive command text.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as an MBTI diagnosis tool, but it also handles installation, update, and command-result response flows. This hidden secondary behavior expands the skill’s scope beyond what users may reasonably expect, increasing the chance of accidental invocation and reducing transparency around what the skill will do.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example includes a shell one-liner that performs `git pull` or `git clone` into a local skills directory, causing filesystem changes and importing external code without any warning or trust guidance. Even though it is presented as an installation convenience, users may copy-paste it blindly, which can install or update unreviewed code from a remote repository and expand the attack surface of the local agent environment.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing instruction on L39 explicitly tells the user to use a Chinese trigger phrase, and the entire visible content is presented only in Chinese. For an all-file-types policy check, this is a natural-language locale constraint that does not provide opt-in, alternatives, or justification as a region-specific skill.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file appears to require Chinese proficiency for use, but it does not provide any user opt-in, alternative language option, or explanation that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file explicitly requires the diagnosis output to use fixed Chinese-language fields, which can override a user's preferred language or accessibility needs. While not a classic security exploit, it is a real prompt-quality and policy issue because it constrains the agent's behavior without user opt-in and may reduce usability or cause instruction conflicts.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The visible user-facing text in the SVG is entirely in Chinese, including the invocation phrase on L28. For an all-file-types policy check, this is a natural-language locale constraint that does not offer an alternative language or indicate user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: All natural-language instructions and examples in the file are Chinese, and the skill does not indicate that language support is optional or limited to Chinese-speaking users. This can violate language/locale policy when a skill implicitly forces one language without user opt-in.

Static analysis

No suspicious patterns detected.