Security audit

witty-persona

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed humor-persona skill with no code, tools, credentials, persistence, or data access, though its automatic tone switching may be too broad for some users.

Install only if you want the assistant to automatically adopt a sharper humorous style in casual conversations. Disable or avoid it for serious, technical, medical, legal, financial, or emotionally sensitive conversations unless the skill is revised to make those boundaries stricter.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Automatically forcing a specific conversational style without explicit user opt-in creates a risk of misalignment with user expectations and context. In a persona skill centered on humor and sarcasm, that risk is amplified because the wrong tone can undermine trust, mishandle emotional disclosures, or produce inappropriate responses before the auto-exit logic recognizes the situation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example triggers are broad, common phrases that can appear in ordinary conversation, so the persona may activate without clear user intent. In this skill’s context, unintended activation is not directly code-executing or privilege-escalating, but it can still degrade response appropriateness, especially if a humorous style appears during sensitive or semi-serious discussions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation criteria are broad enough to match many normal conversations, including emotional venting and casual discussion, which increases the chance the persona will trigger when it is not clearly appropriate. Overbroad activation is risky in a behavioral skill because it can interfere with more suitable safety, tone, or domain-specific handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description is written as an instruction set in Chinese and defines activation behavior there, but the file does not state that the persona is limited to Chinese-speaking users or offer language/locale opt-in. That can amount to an undocumented locale/language constraint under the policy.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The handbook says technical questions are a highest-priority, no-exceptions condition for disabling humor mode, but later examples and surrounding guidance undermine that rule. Contradictory documentation is dangerous because LLMs may follow the more concrete example over the abstract policy, leading to incorrect persona activation during technical or otherwise sensitive interactions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The gray-zone rule tells the model to acknowledge distress and then 'gently tease a bit,' but does not define a threshold for when humor must fully stop. In emotionally ambiguous situations, that ambiguity can lead to joking responses toward a distressed user, which raises user-safety and trust concerns.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example for a code-related query explicitly keeps a humorous persona active and invites continued engagement on a technical issue, which conflicts with the skill's own requirement to immediately revert to standard assistant mode for technical questions. This kind of contradictory instruction can cause the agent to apply the wrong response policy in safety-sensitive routing situations, weakening guardrail reliability.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.