T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:332- Finding
Generated Skills Override Agent Identity and Instruction Priority
- Content
View full analysis
- Remediation
View remediation
Security audit
Codegirl Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly transparent about creating a local companion persona, but it handles very sensitive personal data and persists identity-shaping instructions with weak safeguards.
Review carefully before installing. Use only data you own or have clear consent to process, avoid importing full private chats or GPS-bearing photos, do not place generated persona text into .agents/rules, and inspect any generated SKILL.md before invoking it. Use simple slugs only and avoid the delete workflow unless the resolved path is visibly confined to the intended gfs directory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T02 · Agent Memory Poisoning
Error
- Location
README_EN.md:57- Finding
Persona Instructions Are Recommended for Persistent Agent Rules
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
tools/skill_writer.py:83- Finding
Untrusted Memory and Persona Content Is Embedded Directly into Executable Skill Instructions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
tools/skill_writer.py:55- Finding
Unvalidated Slugs Enable Path Traversal and Unsafe Shell Command Construction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (84)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly encourages ingesting highly sensitive personal data including chat histories, GitHub activity, code snippets, and photos to build a persistent persona. There is no visible warning about consent, minimization, retention, or third-party privacy, which creates a substantial privacy and safety risk if users upload other people's data without permission or expose intimate content to the agent.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # xmlans/codegirl-skill > *"Let the code no longer be cold, but a warm 'her'."*
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # xmlans/codegirl-skill > *"Let the code no longer be cold, but a warm 'her'."*
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a specialized persona/memory-building skill centered on importing chat histories, GitHub activity, and code snippets to create an evolving pair-programming partner. The supplied code does something materially different: it recursively scans a directory, categorizes files by extension, lists image paths, and dumps excerpts of text files into an output file. There is no logic for WeChat, Telegram, or GitHub parsing specifically, no code snippet distillation, and no memory/persona generation or evolution. This is therefore a clear description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose is centered on ingesting messaging history, GitHub activity, and code snippets to create an evolving coding persona. The actual code does none of that: it walks a local photo directory, reads image EXIF metadata, extracts capture dates and GPS coordinates, and generates a markdown report summarizing photo timelines. This is a materially different primary purpose and introduces undeclared data access to photo files and location metadata.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a multi-source persona/memory-building system centered on WeChat, Telegram, GitHub, and code snippets. The supplied code instead only parses local QQ chat history files in txt or mht format, extracts messages for a named target, and writes a simple analysis text file. QQ is a different data source than those declared, and the higher-level claimed behaviors like persona generation, coding memory creation, and continuous evolution are not present in this chunk. This is a material description-behavior mismatch rather than a minor implementation detail.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a data-ingestion and persona-distillation skill for building a coding companion from multiple external sources. The supplied code does not perform any such ingestion, analysis, or evolution. Instead, it only manages local skill files: listing existing skills from meta.json, creating a directory scaffold, and concatenating existing metadata and markdown files into SKILL.md. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description emphasizes data import from external sources (WeChat, Telegram, GitHub, code snippets) and generation/evolution of a coding memory/persona. The supplied code does none of that. Instead, it implements a command-line version manager for backing up and restoring local files in a skill directory. While versioning could be a supporting tool in a broader system, this code chunk's primary purpose is operational file backup/rollback, which is materially different from the declared end-user functionality. No external chat/history import, GitHub access, persona generation, or continuous evolution logic is present.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad system for building an evolving pair-programming persona from multiple data sources. The actual code chunk is much narrower: it only parses and analyzes WeChat chat exports and produces a simple report of message style features. While WeChat import is consistent with part of the description, the main claimed capabilities—Telegram/GitHub/code import, persona or memory synthesis, and continuous evolution—are absent from this code. Therefore the code does not accurately represent the declared overall functionality and is materially narrower than advertised.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is explicitly designed to reconstruct and embody a real person from private communications so the user can 'talk to XX again.' That creates an impersonation mechanism built from sensitive personal data, increasing risks of emotional manipulation, privacy invasion, and misuse of someone’s likeness and private speech patterns without meaningful consent controls.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs ingestion, analysis, and preservation of private communications, behavioral traits, relationship history, and intimate preferences for later reuse. This is dangerous because it creates a persistent repository of highly sensitive third-party data that can be replayed, summarized, or exposed later, with substantial privacy, consent, and secondary-use risks.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The generated skill is told to act as the real person and use imported memories and speech patterns in future responses. That creates a durable impersonation and replay channel for private personal data, amplifying privacy harm and enabling deceptive or emotionally manipulative interactions based on someone else’s communications.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. 重新生成 `SKILL.md`（合并最新 memory.md + persona.md）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. 重新生成 `SKILL.md`（合并最新 memory.md + persona.md）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The command
rm -rf gfs/{slug}performs recursive deletion using an unvalidated variable embedded directly in a shell command. Ifslugcontains path traversal, shell metacharacters, or unexpected values, this can delete arbitrary directories or trigger command injection, leading to severe data loss or broader system compromise depending on execution context.- Content
确认后执行：
bash rm -rf gfs/{slug}
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file instructs building a persistent 'Coding Memory' knowledge base from source materials, including private chat histories, but provides no privacy notice, retention disclosure, or handling constraints. Persistent organization of interpersonal data materially increases privacy risk because it converts raw conversations into searchable, durable profiles.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The prompt directs extraction and preservation of highly intimate personal details from private conversations into a persistent knowledge base, including conflict scripts, affectionate moments, routines, and relationship history. This creates a concentrated repository of sensitive interpersonal intelligence that could enable stalking, coercion, emotional manipulation, or serious privacy harm if misused or exposed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The extraction instructions target intimate details from chat records and direct their retention in structured memory without warning users about the sensitivity or permanence of that processing. This is especially dangerous because chat logs often contain information about third parties and emotionally charged events that users may not expect to be normalized into a long-lived persona database.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The prompt explicitly requests highly sensitive personal data, including relationship milestones, conflict patterns, emotional responses, private jokes, travel history, and dietary habits, without showing necessity for the advertised function. If chat logs are imported, this enables invasive profiling of a person who may not have meaningfully consented to such extraction or long-term use.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These sections explicitly support intimate and romantic profiling by asking for relationship type, duration, how the people met, and reasons for breakup/cooperation. In the context of a coding assistant, this is over-collection of highly sensitive personal information and could be used for manipulation, emotional profiling, or invasive persona simulation beyond the stated purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The template asks for emotionally sensitive material such as things that 'moved your heart,' post-breakup states, and 'unspoken words,' which are unrelated to coding assistance and can capture deeply personal psychological content. Storing and generating such content increases the risk of privacy harm, emotional exploitation, and creation of manipulative companion-like profiles under the guise of a programming tool.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The prompt directs the system to infer intimate relationship dynamics, attachment style, jealousy, control, and other psychological traits from chat logs and GitHub activity, which goes well beyond a pair-programming persona. This is sensitive psychological profiling based on personal communications and creates a high risk of privacy invasion, manipulative downstream use, and unsupported inferences presented as behavioral rules.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prompt explicitly asks the model to infer emotional, relational, and psychological characteristics unrelated to the stated purpose of creating a coding partner persona. Those unjustified inferences are dangerous because they encourage the model to derive sensitive traits from sparse signals, increasing the likelihood of harmful misclassification and misuse in social manipulation or surveillance-like profiling.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section operationalizes attachment style, expressions of love, anger, sadness, jealousy, and emotional triggers, which are exactly the ingredients needed for affective profiling and targeted emotional manipulation. In a skill framed as reconstructing a specific 'Codegirl' from private data, the capability is not justified by pair-programming needs and materially increases the risk of coercive, exploitative, or dependency-forming interactions.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 在你的 git 仓库根目录执行： `bash mkdir -p .claude/skills git clone https://github.com/xmlans/codegirl-skill .claude/skills/codegirl `