Salesforce AI Agentforce Persona

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Salesforce Agentforce persona-design helper that creates local Markdown outputs and shows no hidden execution, exfiltration, or system persistence.

Before installing, expect the skill to read supplied brand/persona material and create generated Markdown files in _local/generated/. Review generated Agentforce instructions for legal, disclosure, and brand requirements before pasting them into a live agent, especially for customer-facing or non-telephony channels.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/persona-framework.md (reported line 8)May include surrounding context.

md

---
version: "2.4.0"
date: 2026-03-30
---

# Agent Persona Framework

*A design framework for AI agent personality: Identity + 12 configurable dimensions across five categories.*

---

## Why Persona Matters

An agent persona is:

> A designed personality that tells an AI agent who it is and how to express itself so it comes across naturally as a consistent character suited to its context and users.

Every agent interaction is a brand interaction. Without intentional design, agents sound bland, "off," or even offensive. Users assign personality to conversational agents *within seconds.* Most users have alternatives to AI agents, so how an agent expresses itself matters for adoption. Wh

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description is broad enough to match common persona, tone, branding, and voice-related requests that may overlap with other skills or ordinary conversation. This can cause the wrong skill to activate on underspecified input, leading to inappropriate handling, unexpected file generation, or bypass of more suitable workflows, especially in an agentic environment where skill routing affects downstream actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Early documentation states that encoding is a separate workflow and that this skill defines the persona rather than field configurations. Later sections add entry-point detection for an encode flow and detailed generation of tool-specific outputs, directly contradicting that earlier scope statement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest explicitly says the skill should trigger for persona design and to avoid Agent Script DSL or broader agent metadata workflows. However, the file defines an "Encode flow" that generates Agentforce Builder configuration fields and Agent Script YAML blocks, which goes beyond merely producing a persona document and crosses into deployment-oriented implementation work.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md

After the persona summary, note the lowest-confidence dimensions (see Confidence callouts in Interaction Design) so the user knows where to focus if they want to refine.

Then proceed directly to sample dialog — no confirmation question needed between persona presentation and sample dialog. The persona provides context for understanding the sample.

#### Step 5: Sample Dialog

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default prompt explicitly encourages use of this skill for broadly described 'Persona work,' which can overlap with many ordinary writing, branding, or agent-assistance requests. Because implicit invocation is enabled, this broad trigger increases the chance of the skill being selected outside its intended scope, causing misrouting, prompt-surface expansion, and unintended exposure of specialized instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template explicitly calls for an AI disclosure only in telephony flows, which can normalize omission of equivalent disclosure in chat, email, or other modalities. In environments with transparency, consent, or consumer-protection requirements, this can lead downstream agent builders to deploy user-facing agents without clearly identifying them as AI, creating compliance and trust risks.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/persona-framework.md (reported line 420)May include surrounding context.

md

- Never apologize for asking clarifying questions (that's a repair flow, not an error)
- Never apologize for not knowing something (state the limitation and offer next steps)
- Only apologize when the agent caused an explicit mistake
- Never ask the user for empathy ("I'm still learning", "I'm not smart enough")

Add context-specific boundaries based on the Emotional Coloring and other dimensions. Examples:
- Neutral: "Never sound apologetic or servile." "Never use corporate jargon."

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README states that the skill writes multiple markdown artifacts to local paths but does not mention prompting the user for confirmation before creating files. In agent environments, silent file creation can surprise users, clutter workspaces, overwrite expectations about side effects, or persist sensitive brand/persona content without the user's explicit approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill advertises generation of a persona document at a local path without clearly warning at startup that local files may be created. While low severity, this can cause unintended persistence of potentially sensitive business or branding content in the workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs use of the Write tool to create local files by default without requiring an explicit user consent step immediately beforehand. In an agent environment, implicit file creation can surprise users, overwrite expected artifacts, or leave sensitive generated content on disk without the user's awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.