Back to skill

Security audit

Reasoning Personas

Security checks for vulnerabilities and agentic risk

Overview

This skill only provides reasoning-persona instructions, with no code execution or data access, though users should know it may change the assistant's tone or critique style automatically.

Install this if you want the assistant to apply stronger critique, precedent-checking, or integration-focused reasoning. Be aware that it may activate from broad contexts like brainstorming, code review, or architecture decisions, and it may not always label the active persona unless your agent or workflow requires disclosure.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description and examples encourage broad activation based on vague user phrasing like brainstorming or review-oriented requests. In an agent system, this can cause the persona logic to trigger in contexts the user did not explicitly intend, subtly changing tone, reasoning style, or recommendations without clear consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The auto-activation map uses ambiguous labels such as brainstorming, code-review, and exploring new ideas without operational boundaries. In a larger agent framework, those broad categories can match many normal tasks, making the skill activate unexpectedly and influence outputs in ways that are hard to predict or audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Allowing the persona to run silently means the system may materially alter reasoning behavior without notifying the user. This reduces transparency and user agency, and makes it harder to detect when advice was shaped by an internally selected adversarial or highly critical framing such as Devil's Advocate or Gonzo mode.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document describes activation prompts and usage but does not define firm boundaries for when persona activation should and should not occur. Without trigger scope and exclusion rules, benign references, quoted text, analysis of personas, or attacker-crafted prompts can induce unintended mode changes that alter reasoning style and reliability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation wording is conversational and broad enough that ordinary discussion like mentioning a mode or persona could unintentionally trigger behavioral changes. In a reasoning skill, that can cause the agent to adopt a high-agency or overly adversarial stance without explicit user intent, leading to misaligned outputs or bypass of normal conversational safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.