Security audit

Persona Forge

Security checks for vulnerabilities and agentic risk

Overview

This skill is presented as a character creator, but the bundled instructions and script mostly implement a broad local text logging system that persistently stores, searches, and exports user input.

Install only if you explicitly want a local logging tool for persona notes and are comfortable with raw prompts and character material being saved under ~/.local/share/persona-forge and later searchable or exportable. Avoid entering sensitive personal, proprietary, or private story material unless you manage and delete the stored files yourself.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest presents this as a character-design skill, but the documented behavior is a generic local logging and data-management utility that stores arbitrary user input, supports search/export, and maintains activity history. This mismatch is dangerous because it can cause users or an agent to invoke the skill under false assumptions, leading to unintended collection, retention, and exfiltration-friendly packaging of sensitive prompt or workflow data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The body of the file documents a broad CLI persistence tool rather than a persona-creation skill, which is a significant semantic integrity issue. In an agent ecosystem, this can enable misuse of the skill for unrelated data handling, causing sensitive content to be written to disk and later searched or exported despite users expecting a creative-writing tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The command surface and help text describe a broad generic record/logging utility rather than a character-design tool. This mismatch is dangerous because users may trust the declared purpose and unknowingly provide sensitive creative notes, prompts, or personal data to a tool that persistently stores and indexes arbitrary input locally across many unrelated commands.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The core handlers do not perform character-generation tasks; they simply append arbitrary user input to per-command log files and history. This creates a covert data collection behavior inconsistent with the skill description, increasing the risk of sensitive user content being retained, searched, and later exposed without informed consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The metadata and the opening documentation contradict each other: one describes a role/character design tool while the other describes a generic utility toolkit. Contradictory documentation increases the chance of unsafe invocation and operator misunderstanding, especially when the actual commands support broad data capture and file-based persistence.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill's stated persona-design purpose conflicts with broad utility-tool language, making its trigger scope ambiguous. That ambiguity is more dangerous here because the documented behavior includes local persistence and aggregation of arbitrary inputs, so accidental activation has privacy and data-handling consequences rather than being a harmless mismatch.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Commands like run, check, convert, analyze, generate, preview, batch, and report are extremely generic and can match many unrelated user intents. In an agent setting, such broad trigger vocabulary can cause accidental invocation and route arbitrary user content into local logs, creating unnecessary data retention and possible exposure through search/export features.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script includes search, stats, recent activity, and export functions over accumulated local logs that are not necessary for the stated character-creation purpose. These capabilities materially increase the blast radius of stored data by making collection easier to enumerate, aggregate, and exfiltrate in bulk if the local environment is shared or compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-supplied input is written verbatim to local log files without notice, sanitization, minimization, or consent. In the context of a creative assistant, users may enter sensitive personal details, unpublished content, or proprietary story material, which then becomes persistently stored and discoverable through the tool's own search/export features.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.