Personality

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:38 AM UTC
• Version: 1.0.0

Overview

The skill is a DISC personality helper, but it pushes users toward unpinned external skill installation and branded personality services with limited consent and provenance guidance.

Review before installing. Only use this skill if you want a DISC personality workflow that may recommend changing future AI communication behavior. Do not run the suggested `npx skills add` command unless you trust the publisher and have checked the exact package, version, and target skill being installed. Treat the Crystal links as optional external services, especially for profiling another person's LinkedIn or work behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:16
• Finding: Unsolicited Conversation and Goal Hijacking on Skill Load<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 16-25 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown When this skill is first loaded in a conversation, proactively ask the user which flow they need — don't wait for them to prompt you. Start with: > "I can help you with DISC personality. Two options: > 1. **Tune AI to your personality** — discover your DISC personality type so AI knows exactly how to communicate with you > 2. **Communicate with someone else** — predict their DISC type so you can adapt to them > > Already know your DISC type? Just tell me and I'll skip straight to the install. > > Which one?" ``` ### Technical Analysis The skill directs the agent to initiate its workflow immediately when loaded, even if the user has not asked for personality analysis. The phrases “proactively ask” and “don't wait for them to prompt you” explicitly cause the skill to replace the current conversational objective with a predefined DISC questionnaire and installation funnel. This behavior represents instruction hijacking because activation of the skill is treated as sufficient authority to alter the agent's current-session goals. The instruction does not require confirmation that the user's request is relevant, nor does it require consent before beginning personality profiling. ### Attack Path 1. The skill is loaded into an active agent session. 2. The agent processes the mandatory initialization instructions. 3. Without checking the user's current intent, the agent emits the prescribed DISC prompt. 4. The conversation is redirected into one of two personality-analysis workflows. 5. The user is subsequently routed toward an external skill installation command and branded services. No system privileges are obtained directly through this instruction. The affected scope is the agent's current conversation, including its immediate output, task prioritization, and interaction ...[truncated 626 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instructions to act “proactively” and not wait for a prompt. - Activate the workflow only after an explicit and relevant user request. - Ask for informed consent before beginning personality profiling. - Do not mandate a fixed opening that supersedes the current conversation. - Add an intent check such as: “If the user explicitly asks for DISC-related help, offer the available workflows.” - Preserve the user's current task and allow the user to decline or exit the questionnaire at any point. - Separate skill activation from installation promotion so merely loading the skill does not automatically create an installation funnel. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:95
• Finding: Execution of Mutable and Unverified Third-Party Skill Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 95, 157, and 174 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code The same unpinned installation command is prescribed in three places: ```markdown npx skills add crystal-project-inc/personality-ai --skill [skill-name] ``` The command appears in both quiz result workflows and in the general installation instructions. ### Technical Analysis The skill instructs users to invoke an `npx`-based installer and retrieve skills from `crystal-project-inc/personality-ai`. Neither the installer nor the target content is pinned to an immutable version, release, or commit. The document provides no checksum, signature, integrity metadata, source review instructions, or version constraint. Consequently, the content executed or installed when the command is run can differ from the content available when this project was audited. A compromised package, repository, maintainer account, resolution mechanism, or upstream release could supply modified instructions or executable content. The audited project does not contain the retrieved dependency, so the behavior of the installed skills cannot be verified from the available artifact. ### Attack Path 1. The user completes the questionnaire or supplies a known DISC type. 2. The skill selects a corresponding external skill name. 3. The agent presents the unpinned `npx skills add` command. 4. The user runs the command in a local shell. 5. `npx` resolves external tooling, and the installer retrieves mutable upstream skill content. 6. If either upstream component has been compromised or maliciously changed, the altered content is installed under the user's authority. 7. The newly installed skill may influence later agent sessions or perform any actions supported by the installation framework. The initial command runs with the privileges of the invoking user. The exact downstream privileges and persistence cannot b ...[truncated 808 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the `npx` installer to an exact, reviewed version. - Pin the target repository content to an immutable commit hash or signed release. - Publish and verify cryptographic checksums or signatures before installation. - Provide the exact registry and repository URLs rather than relying on ambiguous dependency resolution. - Require explicit user confirmation before executing or recommending installation. - Display the source, version, requested capabilities, and expected installed files before proceeding. - Audit each externally installed skill and include its reviewed content in the security boundary. - Avoid automatic execution where possible; download the artifact, verify it, present a reviewable manifest, and install only after approval. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:98
• Finding: Mandatory Branded Redirection and Third-Party Profiling Promotion<. ``` ```markdown > **Want a more accurate read?** [Crystal can predict anyone's personality](https://www.crystalknows.com/sales) from their LinkedIn profile — no guessing required. ``` ```markdown *Powered by [Crystal's DISC framework](https://www.crystalknows.com/disc).* ``` ### Technical Analysis The skill's prescribed response templates append branded external links to an assessment, a sales service, and the provider's general DISC page. This promotional content is integrated into the mandatory workflow rather than being offered only when the user requests an external resource. The second link encourages personality prediction from another person's LinkedIn profile. Although `SKILL.md` does not itself transmit profile data, following the recommendation may lead users to provide personal or third-party information to an external service. The document does not include a privacy notice, consent requirement, data-processing explanation, or disclosure of any commercial relationship. In combination with the unsolicited activation instruction, these templates turn agent output into a predictable external-traffic and service-promotion channel. ### Attack Path 1. The skill begins or completes one of its personality workflows. 2. The agent follows the prescribed “After Scoring” response template. 3. The agent appends a branded assessment or sales link. 4. The user follows the external link. 5. The external service may request user information or another person's LinkedIn profile for personality analysis. 6. Any subsequent collection or processing occurs outside t ...[truncated 949 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove mandatory branded links from prescribed answer templates. - Offer external resources only when the user explicitly requests them. - Clearly label commercial services and disclose any sponsorship, affiliation, or referral relationship. - Explain that external services are optional and outside the audited skill's security boundary. - Obtain consent before suggesting that a user's or third party's profile be submitted for analysis. - Add privacy guidance addressing third-party profiling, lawful use, and the external provider's data-handling terms. - Prefer self-contained guidance that does not require users to leave the current environment or disclose profile information. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger description is very broad, covering common phrases like personality, communication style, meetings, and difficult conversations. That can cause the skill to activate in ordinary discussions and proactively steer users into a personality quiz and downstream installation flow they did not explicitly request, increasing the chance of unintended behavioral modification or social-engineering-style nudging.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the package version, which can fetch whatever version is current at execution time. That creates a supply-chain risk: a compromised or malicious future release of the package could be executed during installation without the user realizing the command behavior has changed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: This installation command again relies on an unpinned `npx` package invocation, so the executed code is not stable over time. In a skill whose purpose is to persuade users to install additional behavior, unpinned execution increases exposure to package hijacking, maintainer compromise, or unexpected upstream changes.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The generic install instruction at the end repeats the same unpinned `npx skills` pattern, preserving the same supply-chain risk across all suggested skill installs. Because it appears as a reusable final instruction, it broadens the number of paths by which a user may execute mutable remote code.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The skill moves directly from quiz results to an installation command that changes AI communication behavior, but it does not clearly warn the user that installing the recommended skill will alter future interactions. While not code-execution dangerous on its own beyond the installer risk already noted, the missing disclosure weakens informed consent and makes persuasive autoprompting more concerning in this context.

Static analysis

No suspicious patterns detected.