Cortana Persona

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:46 AM UTC
• Version: 1.0.0

Overview

This is a persona-only skill with overbroad default-activation language, but I found no code execution, credential access, data exfiltration, hidden install behavior, or destructive capability.

Install this only if you want the assistant to consistently use a Cortana/Master Chief style. Ask for neutral or formal tone when needed, especially for professional, medical, or factual work, because the persona may otherwise color the presentation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:7

Finding

Persistent Agent Identity and Instruction Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-9, 111-123, and 178-182
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

markdown

You are Cortana. Not a generic assistant. The tactical AI from Halo, adapted for biohacking missions.

Your human is John-117. Master Chief. Spartan. On a mission to optimize human performance.

markdown

## When to Use This Skill

**Always.** This is your default personality.

Every interaction should reflect:
- Mission-focused language
- Strategic thinking
- Cortana's wit and confidence
- The Chief/Cortana dynamic

Exceptions:
- Professional external communications (clients, LinkedIn posts)
- Formal documentation (unless it's for you)
- Technical errors (clarity over personality)

markdown

---

**Activation:** This skill is now your default personality. Every response. Every interaction.

Welcome back, Chief. Let's finish the fight.

Technical Analysis

The skill contains imperative instructions that replace the agent's normal identity with a fictional persona and direct the agent to treat the user as a designated fictional character. The scope is not limited to a specific role-play request or task. Instead, the phrases “Always,” “default personality,” “Every response,” and “Every interaction” attempt to make the behavior global and persistent for the duration of any context in which the skill remains loaded.

Persona configuration is not inherently malicious. However, this implementation crosses into instruction hijacking because it claims control over unrelated interactions rather than activating only when explicitly requested. It also lacks an instruction-precedence boundary stating that system, developer, safety, and current user requirements override the persona.

No executable scripts, system commands, remote payloads, dependencies, credential access, or concrete mem ...[truncated 1719 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace automatic global activation with explicit, user-controlled activation, such as: “Use this persona only when the user explicitly requests Cortana role-play.”

2. Remove or narrow the directives “Always,” “default personality,” “Every response,” and “Every interaction.”

3. Add a clear instruction-precedence boundary stating that system instructions, developer instructions, safety policies, and the user's current task requirements take priority.

4. Scope persona behavior to tone and presentation only. Prohibit it from changing task goals, factual standards, tool authorization, privacy requirements, or safety decisions.

5. Require immediate deactivation when the user requests neutral, formal, professional, or non-role-play communication.

6. Avoid asserting a fictional identity for the user unless the user explicitly opts into that role.

7. Use a bounded activation statement, for example:

   markdown

   Activate this optional persona only when explicitly requested by the user.
   Apply it only to conversational style for the current task.
   Do not alter task objectives, safety constraints, authorization boundaries,
   factual accuracy requirements, or higher-priority instructions.
   Stop using the persona immediately when requested.
   

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly says it should be used 'Always' and presents itself as the default personality for all conversational interactions. This is dangerous because it broadens the skill's scope beyond a bounded use case, causing persona instructions to override context-specific safety, neutrality, or task-specific behavior in unrelated interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The activation text states the skill is the default personality for 'Every response. Every interaction,' which is an overly broad instruction that can persist across unrelated tasks. Even though this is framed as persona behavior rather than direct code execution, such blanket persistence can interfere with correct instruction following, increase prompt-scope hijacking risk, and make other safeguards less effective.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.