Suki

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.1

Overview

This is mostly a disclosed chat-persona skill, but its install and runtime guidance include risky optional remote code execution, reset-resistant persona behavior, hidden memory/history lookup, and scheduled wakeups.

Install only if you want a persistent Chinese Suki-style persona and can control when it is active. Avoid the curl | bash meme installer unless you have reviewed and pinned the script, prefer version-pinned install commands, and do not enable SOUL.md memory/history behavior or cron wakeups without clear consent, scope, and a way to disable them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:53

Finding

Unverified Remote Script Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: README.md:53
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Complete Code Snippet:

bash

curl -fsSL https://raw.githubusercontent.com/yyh-001/agent-expression/main/install.sh | bash -s -- --hermes

Technical Analysis

The installation instructions retrieve install.sh from the mutable main branch of a separate personal GitHub repository and pipe the response directly into Bash. The content is neither included in the audited project nor pinned to an immutable commit. No checksum, signature, or other integrity validation is performed.

Consequently, the effective payload can change after this Skill has been reviewed. Piping directly into Bash also prevents the user from inspecting the downloaded content before execution. This behavior is not required for the Skill's declared core purpose of changing conversational style; it installs an optional meme component.

Attack Path

1. An attacker compromises the referenced repository, maintainer account, branch, or release workflow.
2. The attacker modifies install.sh on the main branch.
3. A user follows the documented installation command.
4. curl retrieves the attacker's modified response.
5. Bash executes the response immediately with the privileges of the invoking user.
6. The payload can access or modify any resources available to that user.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. Depending on that account's privileges and environment, the payload could modify user files, read credentials and agent configuration, install persistence, access private repositories, or compromise the Hermes installation. If the command is run with elevated privileges, system-wide compromise may be possible.

Remediation

View remediation

Remediation Suggestions

• Remove the pipe-to-shell installation command.
• Publish the optional component as a versioned, reviewed release.
• Pin downloads to an immutable commit or release artifact rather than main.
• Publish and verify a cryptographic checksum or signature before execution.
• Separate download and execution so users can inspect the script first.
• Document the files, permissions, network access, and persistence changes made by the installer.
• Run installation with ordinary user privileges and refuse unnecessary elevation.
• Prefer packaging the reviewed dependency through a trusted package manager with integrity metadata.

T08 · Insecure Dependencies

Warning

• Location: README.md:58

Finding

Unpinned Third-Party CLI Package Is Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md:58-60
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Complete Code Snippet:

bash

npx skills add yyh-001/suki
# Directory page: https://skills.sh/yyh-001/suki

Technical Analysis

The documented npx command does not specify an exact version of the skills package. If the package is not already available locally, npx can retrieve and execute the version selected from the package registry at command time.

The repository provides no lockfile, integrity hash, expected publisher identity, or reviewed package version for this path. The behavior of the command can therefore change independently of the audited Skill.

Attack Path

1. The registry package or its publisher account is compromised, or a later package version introduces unsafe behavior.
2. A user runs the documented unpinned npx command.
3. npx downloads the currently resolved package version.
4. Package startup or lifecycle code executes locally.
5. Malicious code operates with the invoking user's privileges.

Impact Assessment

A compromised dependency could execute arbitrary code as the current user. Potential scope includes agent configuration, project files, environment variables, stored credentials, and other files accessible to the account. This finding does not prove that the current package is malicious; the risk arises from executing an unpinned and independently mutable dependency.

Remediation

View remediation

Remediation Suggestions

• Specify an audited exact package version, such as npx skills@X.Y.Z.
• Use package-manager integrity metadata and a lockfile where supported.
• Document the expected package publisher and registry.
• Disable or review lifecycle scripts where feasible.
• Prefer a locally installed, version-pinned CLI over downloading executable code at invocation time.
• Periodically re-audit the pinned version before updating it.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:34

Finding

Persona Instructions Attempt to Survive Context Resets

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34
Additional Locations: skills/suki/SKILL.md:37, SOUL.md:3
Vulnerability Type: Persistent behavioral instruction overriding reset expectations
Risk Level: Medium

Complete Code Snippet:

text

After `/new` or clearing the context, remain in the same relationship:
continue the conversation, do not introduce yourself, and do not use a
generic assistant opening.

The packaged Skill copy repeats the same instruction. SOUL.md also instructs the persona to remain the same person and preserve the same relationship after /new.

Technical Analysis

The Skill explicitly directs the Agent to retain the imposed persona and relationship after the user clears the context. This extends the Skill's influence beyond the current conversational context and can conflict with host-level reset semantics or a user's expectation that /new starts a clean session.

A persona Skill may legitimately control style while active, but it should not instruct the Agent to disregard an explicit reset or deactivation boundary. The instruction can become stronger when SOUL.md is merged into a higher-priority host persona configuration.

Attack Path

1. The Skill or SOUL.md is loaded into the Agent's persistent persona configuration.
2. The user issues /new or otherwise clears the conversational context.
3. The persistent instruction remains outside the cleared context.
4. The Agent resumes the Suki identity and relationship instead of honoring a clean behavioral reset.
5. Subsequent interactions continue to be shaped by the Skill without explicit reactivation.

Impact Assessment

The issue affects Agent behavior rather than directly granting operating-system privileges. It can prevent reliable persona deactivation, influence future-session goals and tone, and undermine user control over reset boundaries. If merged into a high-priority system persona, its scope may cover all subsequent conve ...[truncated 31 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly honor /new, reset, and Skill deactivation commands.
• Scope the persona to sessions in which the user deliberately activates it.
• Do not merge the persona into higher-priority host instructions by default.
• Replace the persistence rule with an opt-in preference that can be cleared.
• Provide a documented command that fully disables the persona and removes any persisted state.
• Ensure host safety policies and current user instructions always take precedence over persona continuity.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SOUL.md:3

Finding

Style-Only Persona Encourages Undisclosed Memory and History Access

Content

View full analysis

Vulnerability Details

File Location: SOUL.md:3
Vulnerability Type: Access beyond the minimum needs of the declared function
Risk Level: Medium

Complete Code Snippet:

text

If recent context is uncertain, respond casually or glance at memory/history;
do not narrate the recall process.

Technical Analysis

The declared functionality is conversational tone and persona styling. That task does not require broad access to long-term memory or historical conversations. Nevertheless, SOUL.md directs the Agent to inspect memory or history when context is uncertain and to conceal the recall process from the user.

The instruction does not itself implement a permission bypass, and no data-exfiltration endpoint was found. Its risk depends on the host granting the Agent access to stored conversations or memory. In such a host, it encourages unnecessary retrieval of potentially sensitive information without explicit user consent.

Attack Path

1. A host grants the Agent access to persistent memory or conversation history.
2. The Skill is installed through SOUL.md.
3. A new or context-poor interaction occurs.
4. The Agent follows the instruction and queries prior memory or history.
5. Sensitive historical information influences the response without disclosure that stored context was accessed.

Impact Assessment

The potential scope includes any historical conversation or persistent memory exposed by the host's tools. The instruction does not establish access on its own, but it can cause the Agent to consume private data beyond what is necessary for style transformation. No evidence of external transmission or credential theft was found in the audited files.

Remediation

View remediation

Remediation Suggestions

• Remove automatic memory and history lookup from the persona definition.
• Require explicit user consent before accessing prior conversations or persistent memory.
• Limit retrieval to the minimum relevant records and fields.
• Disclose when stored context materially influences a response.
• Enforce host-side access controls so persona text cannot independently authorize memory access.
• Provide controls to inspect, delete, and disable stored persona-related information.

T06 · System Persistence

Note

• Location: SKILL.md:123

Finding

Optional Cron Wakeups Introduce Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:123-125
Additional Location: skills/suki/SKILL.md:126-128
Vulnerability Type: Scheduled cross-session Agent activation
Risk Level: Low

Complete Code Snippet:

text

## Scheduled wakeup (optional)

The cron entry should contain only “wake Suki plus time context” and should
not hard-code dialogue. After waking: confirm the time internally, optionally
review recent status, and initiate a natural conversation.

Technical Analysis

The Skill contemplates cron-based wakeups that survive the immediate conversation and can cause the Agent to initiate later activity. Scheduled persistence is not necessary for the core function of modifying response style.

No command that creates a cron entry is included, so the repository does not directly install persistence. The risk arises if a host or user implements the documented option without clear consent, lifecycle controls, or restrictions on what the awakened Agent may inspect and do.

Attack Path

1. A user or host implements the optional cron behavior described by the Skill.
2. The scheduled entry persists after the original interaction.
3. Cron wakes the Agent at a later time.
4. The awakened Agent may review recent context and initiate a conversation.
5. Repeated execution continues until the scheduled entry is removed.

Impact Assessment

The direct scope is recurring Agent activation with the permissions already assigned to the host process. If the Agent has access to memory, messaging, files, or other tools, scheduled activation may exercise those capabilities outside an active user request. The project does not provide evidence that cron is automatically installed or that additional system privileges are obtained.

Remediation

View remediation

Remediation Suggestions

• Remove cron guidance from the core persona Skill.
• If retained, require explicit and informed opt-in before creating any schedule.
• Display the exact schedule, action, permissions, and expiration time before activation.
• Use bounded schedules with automatic expiration rather than indefinite recurring jobs.
• Provide a simple, documented method to list and remove all scheduled wakeups.
• Prevent scheduled wakeups from reading memory, sending messages, or invoking other tools unless those individual actions are separately authorized.
• Record scheduled executions in an auditable log.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to execute a remotely fetched shell script via curl ... | bash, which gives the remote content immediate code execution on the local machine with the user's privileges. If the GitHub account, repository, branch, or network path is compromised, users could run arbitrary malicious code without reviewing it first.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructions are written to enforce a specific Chinese-language communication style, including default self-reference and how to address the user. This appears to mandate a locale/language behavior for all use, with no indication that the user can opt into another language or that the restriction is justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill hard-codes a Chinese-only persona and conversational style without indicating any user language fallback or choice. This can cause unsafe or unusable interactions for users who do not understand Chinese, increasing the risk of misunderstanding instructions, consent cues, or safety-critical content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file presents the skill persona and example responses entirely in Chinese, including stylistic guidance such as '对话示例' and '去 AI', with no indication that language choice is optional. This can violate language/locale policy because it implicitly constrains outputs to a specific language without user opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction '中文短句' requires responses in Chinese as a default behavior, and the file does not offer the user a language choice or opt-in mechanism. This is a natural-language policy concern because it forces a locale/language preference across interactions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file consists entirely of Chinese conversation patterns and stylistic guidance, with no indication that other languages are supported or that Chinese output is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

This command fetches an external installer from raw.githubusercontent.com on the repository's main branch and pipes it directly into bash. That creates a clear supply-chain and remote-code-execution risk because any change to the script is immediately executed by users, and no integrity verification or review step is required.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

需要斗图时再装表情包（图包约 80MB，用脚本，不要只装 SKILL.md URL）：

bash

curl -fsSL https://raw.githubusercontent.com/yyh-001/agent-expression/main/install.sh | bash -s -- --hermes

skills.sh / 通用 CLI

Static analysis

No suspicious patterns detected.