Security audit

persona-distiller

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local chat-to-persona tool, but it automatically loads reusable persona prompts from private chats and includes unsafe export/file-write behaviors that need review before installation.

Install only if you are comfortable with local chat logs being transformed into persistent persona prompts. Use it only on conversations you have permission to analyze, review and redact generated persona JSON before activation, avoid automatic startup loading, and do not use Windows clipboard export until the PowerShell injection issue is fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:28
Finding: Automatic Loading of Persistent Persona Instructions Enables Memory Poisoning and Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/distil.py:365
Finding: Chat-Derived and User-Controlled Values Are Converted into AI Activation Instructions
Content: View full analysis
1 else a['top_openers'][0]}" ) if top_words_list[:6]: prompt_parts.append( f"Catchphrases/frequent words: {', '.join(top_words_list[:6])}" ) if fav_particles: prompt_parts.append( f"Sentence particles: {', '.join(fav_particles[:4])}" ) ``` The resulting string is stored as an activation instruction: ```python persona = { # Other persona fields omitted "system_prompt_snippet": snippet, } ``` It is subsequently presented for direct AI-context injection by `scripts/activate.py:115-134`: ```python snippet = data.get("system_prompt_snippet", "") if not snippet: print("Persona has no system_prompt_snippet") sys.exit(1) print(snippet) print("The following content can be injected directly into AI context") print(snippet) ``` ### Technical Analysis The persona name comes from the `--name` argument or the input filename. Chat-derived openers, frequent words, slang, and other values also originate from untrusted input. These values are interpolated directly into imperative prompt text without a trust boundary, escaping scheme, control-character filtering, or semantic validation. In particular, `name` is not restricted to a single line. A crafted name can contain newline-delimited instructions that become part ...[truncated 1593 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/activate.py:160
Finding: PowerShell Command Injection Through Persona Clipboard Export
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/activate.py:257
Finding: Path Traversal in Blank Persona Creation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description centers on extracting a personality model from chat history and generating a structured persona/snippet, with triggers around analyzing chats or speaking in an existing persona. However, the supplied code does not distill chat logs at all. Its primary behavior is local persona file management: reading JSON persona files, listing them, showing details, printing activation snippets, exporting snippets, deleting files, interactively editing fields, and creating empty personas. While activating and using existing personas is adjacent to the description, the dominant implemented capabilities in this chunk are management operations that are not declared, including delete/edit/new/export. The code also accesses local filesystem storage (~/.qclaw/personas) and clipboard/output for export, which are not reflected in the declared permissions. Therefore the description does not accurately represent this code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents this as a persona-distillation skill that analyzes chat logs and produces a structured personality model plus prompt snippets. The supplied code does none of that analysis or generation. Instead, it is a preprocessing utility: it loads a WeChat-exported XLSX workbook, filters for text messages, counts senders, groups messages by sender, and saves each sender’s messages into separate .txt files. While this may be a supporting step for a later distillation pipeline (as hinted by the comment about 'distil.py'), the actual code chunk’s primary behavior is data extraction and formatting, not personality modeling. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是“聊天记录人格蒸馏”功能，核心能力应是从聊天内容中分析一个人的说话风格与人格特征，并生成结构化模型和提示词片段。而实际代码并不处理聊天记录，也没有任何人格分析、抽取或生成逻辑。它只是一个离线修复/迁移脚本：读取本地 persona 文件，为 tone 数值字段补充中文标签和描述，并对 system_prompt_snippet 中的固定字符串做替换后保存。因此其主要用途与声明明显不一致。虽然代码操作的是 persona 相关数据，属于同一领域，但功能层级上只是数据修复工具，不是人格蒸馏技能。
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is designed to analyze personal chat logs and produce impersonation-style persona profiles, yet the description does not prominently warn about privacy, consent, and misuse risks. In this context, hidden or understated impersonation capability is dangerous because it normalizes extraction of behavioral traits from private communications and reuse across later interactions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises shell and local file read/write workflows but declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent could invoke filesystem or shell capabilities more broadly than users expect, especially around local chat logs and persona files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The natural-language description and trigger examples are entirely written as Chinese-only usage patterns, implying the skill is designed around a single language/locale. There is no indication that users may opt into another language or that the restriction is intentionally documented as region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on vague references to a person or on every new conversation via automatic scanning. That can cause unprompted loading of persona data and unintended processing of sensitive local content, increasing the chance of privacy violations or impersonation without explicit user consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Automatically loading and 'remembering' all persona snippets derived from chat logs creates cross-conversation retention of user-derived behavioral data. This is dangerous because it establishes a persistent natural-language memory channel for sensitive or identifying information, enabling reuse, leakage, and unauthorized impersonation beyond the original analysis session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide instructs users to distill raw chat logs into persona files and inject a generated system prompt into future AI conversations, but it provides no warning about privacy, consent, retention, or sensitive-data handling. In this skill context, that omission is materially risky because chat logs commonly contain personal data, confidential content, and third-party information that may be embedded into reusable prompts or stored on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring and CLI usage are written entirely in Chinese, and the rest of the script continues this fixed-language behavior in user-facing prompts and messages. Because the file does not provide any opt-in, locale selection, or justification that the tool is intended only for a Chinese-speaking region or audience, this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes distilling personality traits from chat logs and using existing personas to speak in someone's style, but this file also implements export, delete, interactive edit, and creation of blank personas. Those are broader CRUD-style persona repository management capabilities, not just analysis or activation of distilled personas.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill modifies the system clipboard via an OS-specific subprocess, which creates side effects outside the tool's core analysis/activation role and exposes sensitive persona content to other applications. In this implementation the clipboard operation is especially risky because it is performed through a PowerShell command containing untrusted persona text, amplifying the impact into possible command execution on Windows.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 89% confidence
Finding: The code builds a PowerShell command string by interpolating untrusted persona content directly into Set-Clipboard -Value '{snippet}'. If snippet contains a single quote or PowerShell metacharacters/subexpressions, it can break out of the quoted string and execute arbitrary commands when export is used on Windows. Because persona files are user-modifiable and can be created from chat-derived content, this is effectively command injection through local data.
Content: Scanner excerpt · scripts/activate.py (reported line 160)May include surrounding context.
python
try: import platform if platform.system() == "Windows": subprocess.run( ["powershell", "-Command", f"Set-Clipboard -Value '{snippet}'"], check=True, capture_output=True )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The autogenerated system_prompt_snippet is always constructed in Chinese and instructs the AI role behavior in that language. This imposes a specific language on downstream AI interactions without offering the user a language choice or documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: New personas are initialized with a default system_prompt_snippet in Chinese, which sets a fixed language expectation for future AI responses. There is no opt-in, configuration option, or documentation indicating that this language restriction is intentional and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: read_input() treats any existing path as a file to open and ingest, allowing arbitrary local file reads when the input argument is attacker-influenced. Combined with persistent persona saving, the tool can silently transform sensitive local content into a stored JSON artifact without any explicit privacy notice or consent boundary.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The core feature builds a reusable persona and system_prompt_snippet from chat logs, carrying forward high-frequency words, slang, topics, and stylistic markers into a persistent file. This creates a durable derived artifact from potentially private conversations, increasing the risk of privacy leakage, impersonation misuse, and unintended propagation of sensitive traits or content into later interactions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script accepts a user-supplied --output path and writes the generated persona JSON there without restricting it to the persona storage directory or validating the destination. In an agent/skill context, this expands the tool from persona distillation into arbitrary file write capability, which can overwrite unrelated files or place attacker-controlled content in sensitive locations if another component invokes it with untrusted arguments.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script explicitly tells users to copy the generated snippet into an AI system prompt, encouraging long-term reuse of content derived from private chats in a privileged prompt context. That increases the chance that personal language patterns, topics, or sensitive details will be exposed to downstream models, logs, or third-party services and reused beyond the original purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The hard-coded self_reference value ["我"] can bias generated persona prompts toward Chinese first-person phrasing even when the user or source material is in another language. In this skill, which automatically distills and reuses personas across conversations, that can silently steer model behavior and cause unauthorized language/style imposition, reducing user control and potentially misrepresenting the impersonated person.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: At L020 the document says the persona file location can be set arbitrarily ("自己设置即可"), but the very next workflow instructions and auto-activation behavior hard-code C:\Users\21115\.qclaw\personas\ and script paths under C:\Users\21115\.qclaw\skills\persona-distiller\. This is an intent/documentation contradiction rather than a mere omission, because the text explicitly promises configurability while prescribing a fixed path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file forces a specific language for all instructions and examples, which can violate a language/locale policy when no user opt-in or justification is provided. There is no indication that the skill is intentionally limited to a Chinese-only audience or region-specific use case.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest focuses on extracting structured personality models from chats and reusing them for prompting, but cmd_export can write persona snippets to any user-specified file path. File export is not clearly described in the skill purpose and expands behavior from internal persona use to external artifact generation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This JSON manifest contains a concrete self-reference token of "我", which implies a language/persona constraint, but the file provides no surrounding trigger scope, usage conditions, or exclusions explaining when this persona should apply. In a manifest file, such under-specified behavioral cues can contribute to ambiguous invocation or unintended use across contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.