Voice Dossier Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 19.0.0

Overview

The skill has a coherent marketing purpose, but it asks agents to persist private-derived voice records beyond the read-oriented capability profile it declares.

Install only if you are comfortable granting explicit permission for this skill to store derived voice and claim records for future sessions. Before saving, review the exact destinations and content, especially if source emails, decks, or posts contain confidential business information.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:40

Finding

Persistent State Writes Exceed the Declared Capability Ceiling

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20, 40-43, 62, 65, 70; distribution-manifest.json:2-6
Vulnerability Type: Capability declaration mismatch and unauthorized persistent-state modification
Risk Level: Medium

Vulnerable Code

distribution-manifest.json:2-6:

json

"capabilities": [
  "inline-delivery",
  "canonical-state-read"
],
"capability_ceiling": "lite",

SKILL.md:40-43:

markdown

- **Reads**: the user's own posts/emails/decks; open own-profiles via keyless sources where available; accepted channel projection and declared operating profile; persona evidence; current Narrative canon/version; and prior voice-view revision when revising.
- **Writes**: the working dossier to `memory/social/voice-dossier-builder/`; the registry-grade voice record to `memory/events/channels.ndjson` via an authorized `operation: propose` request to `registry-events.py` for promotion ([channel-registry](../../../protocol/channel-registry/SKILL.md) is the sole writer of `memory/channels/`); disclosure or boilerplate wording that makes a product/offer claim to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py`.
- **Promotes**: a 1-2 line banned-phrase + disclosure-line pointer to `memory/hot-cache.md` (ask first); corpus gaps (platforms with under 10 usable own posts) to `memory/open-loops.md`.
- **Done when**: every register row and every few-shot cites an own post (ID/URL/date); disclosure lines cover founder/employee/advocate and AI-media contexts; pillars sum to 100% with every % labeled Estimated; and the versioned record sits in `memory/events/channels.ndjson` via an authorized `operation: propose` request to `registry-events.py`.

SKILL.md:62-65:

markdown

5. **Codify banned phrases and disclosure lines** — the confirmed banned list, then one disclosure line per context: founder/employee posting about the product, advocate reshar
...[truncated 5410 chars]

Remediation

View remediation

Remediation Suggestions

1. Align the manifest with actual behavior. If persistent writes are necessary, declare narrowly scoped capabilities for:

   • Workspace-result writes under memory/social/voice-dossier-builder/.
   • Proposal-only appends to memory/events/channels.ndjson.
   • Proposal-only appends to memory/events/claims.ndjson.
   • Any permitted cache or open-loop updates.

2. If the lite profile must remain read-only, remove all filesystem and registry writes. Return the dossier inline and instruct an independently authorized component to perform optional persistence.

3. Require explicit, informed confirmation immediately before every persistence operation. The prompt should identify:

   • The exact destination.
   • The categories of data being stored.
   • Whether the data will affect future sessions or other agents.
   • The retention and deletion behavior.

4. Enforce manifest capabilities at runtime rather than trusting natural-language instructions. Reject undeclared write operations even if the Skill labels them “authorized.”

5. Restrict registry-events.py with operation-level authorization, destination allowlists, append-only semantics, schema validation, record-size limits, and audit logging.

6. Minimize persisted content. Store references or redacted summaries where possible, and avoid copying sensitive source emails, decks, or posts into shared registries.

7. Clarify the consent rule in SKILL.md so that “Do not write memory without asking” unambiguously covers working copies, event streams, cache files, and open-loop files.

8. Add automated package validation that compares paths and operations mentioned in Skill instructions against the capabilities declared in distribution-manifest.json, failing publication when they conflict.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

## Save Results

After delivering the dossier, ask: "Save these results for future sessions?" On confirmation, save to `memory/social/voice-dossier-builder/YYYY-MM-DD-<brand>-voice-dossier.md` — see [Skill Contract](../../../references/skill-contract.md) §Save Results Template. The registry-grade record goes only to `memory/events/channels.ndjson` via an authorized `operation: propose` request to `registry-events.py`; claim wording goes only to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py`. Do not write memory without asking.

## Reference Materials