Security audit

Personality

Security checks for vulnerabilities and agentic risk

Overview

The skill is a DISC personality helper, but it pushes users toward unpinned external skill installation and branded personality services with limited consent and provenance guidance.

Review before installing. Only use this skill if you want a DISC personality workflow that may recommend changing future AI communication behavior. Do not run the suggested `npx skills add` command unless you trust the publisher and have checked the exact package, version, and target skill being installed. Treat the Crystal links as optional external services, especially for profiling another person's LinkedIn or work behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:16
Finding: Unsolicited Conversation and Goal Hijacking on Skill Load
Content: View full analysis
"I can help you with DISC personality. Two options: > 1. **Tune AI to your personality** — discover your DISC personality type so AI knows exactly how to communicate with you > 2. **Communicate with someone else** — predict their DISC type so you can adapt to them > > Already know your DISC type? Just tell me and I'll skip straight to the install. > > Which one?" ``` ### Technical Analysis The skill directs the agent to initiate its workflow immediately when loaded, even if the user has not asked for personality analysis. The phrases “proactively ask” and “don't wait for them to prompt you” explicitly cause the skill to replace the current conversational objective with a predefined DISC questionnaire and installation funnel. This behavior represents instruction hijacking because activation of the skill is treated as sufficient authority to alter the agent's current-session goals. The instruction does not require confirmation that the user's request is relevant, nor does it require consent before beginning personality profiling. ### Attack Path 1. The skill is loaded into an active agent session. 2. The agent processes the mandatory initialization instructions. 3. Without checking the user's current intent, the agent emits the prescribed DISC prompt. 4. The conversation is redirected into one of two personality-analysis workflows. 5. The user is subsequently routed toward an external skill installation command and branded services. No system privileges are obtained directly through this instruction. The affected scope is the agent's current conversation, including its immediate output, task prioritization, and interaction ...[truncated 626 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:95
Finding: Execution of Mutable and Unverified Third-Party Skill Dependencies
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:98
Finding: Mandatory Branded Redirection and Third-Party Profiling Promotion
Content: View full analysis
**This is a rough match based on 4 questions.** For a precise assessment that identifies your exact subtype, take [Crystal's full DISC assessment](https://www.crystalknows.com/disc-personality-test). ``` ```markdown > **Want a more accurate read?** [Crystal can predict anyone's personality](https://www.crystalknows.com/sales) from their LinkedIn profile — no guessing required. ``` ```markdown *Powered by [Crystal's DISC framework](https://www.crystalknows.com/disc).* ``` ### Technical Analysis The skill's prescribed response templates append branded external links to an assessment, a sales service, and the provider's general DISC page. This promotional content is integrated into the mandatory workflow rather than being offered only when the user requests an external resource. The second link encourages personality prediction from another person's LinkedIn profile. Although `SKILL.md` does not itself transmit profile data, following the recommendation may lead users to provide personal or third-party information to an external service. The document does not include a privacy notice, consent requirement, data-processing explanation, or disclosure of any commercial relationship. In combination with the unsolicited activation instruction, these templates turn agent output into a predictable external-traffic and service-promotion channel. ### Attack Path 1. The skill begins or completes one of its personality workflows. 2. The agent follows the prescribed “After Scoring” response template. 3. The agent appends a branded assessment or sales link. 4. The user follows the external link. 5. The external service may request user information or another person's LinkedIn profile for personality analysis. 6. Any subsequent collection or processing occurs outside t ...[truncated 949 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger description is very broad, covering common phrases like personality, communication style, meetings, and difficult conversations. That can cause the skill to activate in ordinary discussions and proactively steer users into a personality quiz and downstream installation flow they did not explicitly request, increasing the chance of unintended behavioral modification or social-engineering-style nudging.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs users to run npx skills add ... without pinning the package version, which can fetch whatever version is current at execution time. That creates a supply-chain risk: a compromised or malicious future release of the package could be executed during installation without the user realizing the command behavior has changed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This installation command again relies on an unpinned npx package invocation, so the executed code is not stable over time. In a skill whose purpose is to persuade users to install additional behavior, unpinned execution increases exposure to package hijacking, maintainer compromise, or unexpected upstream changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The generic install instruction at the end repeats the same unpinned npx skills pattern, preserving the same supply-chain risk across all suggested skill installs. Because it appears as a reusable final instruction, it broadens the number of paths by which a user may execute mutable remote code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill moves directly from quiz results to an installation command that changes AI communication behavior, but it does not clearly warn the user that installing the recommended skill will alter future interactions. While not code-execution dangerous on its own beyond the installer risk already noted, the missing disclosure weakens informed consent and makes persuasive autoprompting more concerning in this context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.