Security audit

Brand Persona Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is not evidently malicious, but it runs mutable npm tooling and generates brand agents with broad command, file, and web permissions that need review before use.

Review before installing. Pin and verify the `openpersona` package version, run generation in a restricted workspace, remove broad default runtime tools from generated agents unless a declared service truly needs them, and make persistence plus ACN registration explicit user-approved steps.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:223
Finding: Execution of an Unpinned npm Package Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: assets/brand.persona.template.json:111
Finding: Generated Agents Receive Excessive Command Execution and Network Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 47)May include surrounding context.
md
## Prerequisites - `skills/anyone-skill/SKILL.md` must be present - `skills/open-persona/SKILL.md` must be present - `npx openpersona` must be available (`npm install -g openpersona` or use `npx`)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 48)May include surrounding context.
md
## Prerequisites - `skills/anyone-skill/SKILL.md` must be present - `skills/open-persona/SKILL.md` must be present - `npx openpersona` must be available (`npm install -g openpersona` or use `npx`) Optional:

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx openpersona without pinning a package version or integrity source. That allows the fetched code to change over time, and if the package, dependency chain, or registry resolution is compromised, users may execute unintended code during installation or use.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 53)May include surrounding context.
md
Optional: - `skills/persona-knowledge/SKILL.md` — enables persistent brand knowledge base (auto-detected by `anyone-skill`) ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listed trigger phrases include broad natural-language requests like 'generate a persona for my brand' and 'help me create a brand agent', which can overlap with normal conversation. In agentic systems, ambiguous triggers can cause unintended skill activation, leading to unauthorized workflow execution, data collection, or file generation when the user did not explicitly intend to invoke this skill.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 111)May include surrounding context.
md
### Phase 4 in detail — Four generation steps | Step | What happens | | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 4a | `npx openpersona create` generates the persona pack. `agent-card.json` and `acn-config.json` are auto-generated — A2A discoverability requires no extra work. | | 4b | `assets/behavior-guide.template.md` is filled with brand-specific values and written to `soul/behavior-guide.md`, overwriting the framework default |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: npx openpersona create pulls and executes a package at runtime without a pinned version, creating a supply-chain execution risk. In this skill's context, the command is part of the generation flow, so operators are more likely to execute it directly, increasing practical exposure.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 126)May include surrounding context.
md
Every brand agent generated by this skill includes five universal commercial behavior standards in its `soul/behavior-guide.md`: | Standard | What it enforces | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | **Onboarding** | On first activation, introduce in brand voice and offer 3 recommended first questions | | **Data priority** | Live data (MCP/API/Webhook) > static knowledge > honest redirect. Never answer real-time questions with unqualified static values. |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The built-in behavior standards state that generated agents should "Always speak in the brand's own tone," but the documentation does not indicate any user opt-in or language/locale selection. Because the skill is intended for broad commercial use, a fixed output style without user choice can conflict with organizational language/locale policy requirements.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The ACN registration example uses npx openpersona without version pinning, again exposing users to mutable package execution from the registry. Because registration is an operational step that may run in production-like environments, compromise could affect agent credentials, config, or deployment state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad enough to match ordinary branding or marketing assistance requests, increasing the chance this orchestration skill activates unexpectedly. Unexpected activation matters here because the skill can lead to file generation, dependency loading, web research, and shell command execution paths.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 84% confidence
Finding: The skill explicitly directs loading another skill by path (skills/anyone-skill/SKILL.md) and following its instructions. Chaining into another skill expands the trust boundary and can import unsafe behavior or prompt-injection content from that dependency, especially since skills are treated as adversarial input.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
## Phase 1A — Brand Soul Distillation (Primary path — selected A) Load `skills/anyone-skill/SKILL.md` and follow its instructions. When anyone-skill asks "Who do you want to distill?", select `**[6] Archetype`** — composite persona with no single real-world subject. This is the correct type for a brand persona.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: This line reveals and conditionally interacts with another installed skill (skills/persona-knowledge/SKILL.md) and its persistent store behavior. Enumerating installed skills and automatically routing data into persistent storage increases attack surface and can expose environment structure or cause sensitive business content to be stored without strong user awareness.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
| Product catalog / FAQ document | `.md` / `.pdf` → `universal` adapter | **Note**: if `skills/persona-knowledge/SKILL.md` is present, anyone-skill will automatically route brand knowledge into the MemPalace persistent store. No extra steps needed. **Output**: a structured brand persona draft with four dimensions extracted:

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
For each service declared above, the implementation method is **transparent to this skill** — the brand chooses based on what they have: | Implementation | When to use | Example | | ------------------ | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | | Knowledge response | Information queries, no system integration | Business hours, product descriptions, policies | | Local script | Specific business operations | Queue number generation, appointment booking |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 84% confidence
Finding: The instruction to load skills/open-persona/SKILL.md and follow it creates another unbounded cross-skill execution path. In this context, that dependency directly precedes shell execution and file generation, so unsafe instructions in the downstream skill could materially affect the host environment.
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
md
## Phase 4 — Generate Persona Pack Load `skills/open-persona/SKILL.md` and follow its generation instructions. ### Step 4a — Run the generator

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs the host to execute npx openpersona create without pinning a specific package version. npx may fetch the latest package at runtime, which creates a supply-chain risk: a compromised or breaking upstream release could execute arbitrary code in the agent environment during skill use.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
Fill `skills/brand-persona-skill/assets/behavior-guide.template.md` with brand-specific values and write the result to `./{slug}-skill/soul/behavior-guide.md`, overwriting the framework default. Apply this mapping: | Placeholder | Source | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------- | | `{{brandName}}` | Phase 1A/1B brand name | | `{{oneLinerBio}}` | Phase 1A/1B one-line bio |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
md
| Placeholder | Source | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------- | | `{{brandName}}` | Phase 1A/1B brand name | | `{{oneLinerBio}}` | Phase 1A/1B one-line bio | | `{{onboardingQuestion_1/2/3}}` | 3 realistic first questions a customer would ask this brand | | `{{blindspotRedirect}}` | Escalation channels declared in Phase 2 (human handoff channel, official website, customer service number, etc.) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
md
| Placeholder | Source | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------- | | `{{brandName}}` | Phase 1A/1B brand name | | `{{oneLinerBio}}` | Phase 1A/1B one-line bio | | `{{onboardingQuestion_1/2/3}}` | 3 realistic first questions a customer would ask this brand | | `{{blindspotRedirect}}` | Escalation channels declared in Phase 2 (human handoff channel, official website, customer service number, etc.) | | `{{confirmationRequiredOps}}` | Action services from Phase 2 that require confirmation (list each by name) |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The ACN registration step also uses unpinned npx openpersona, which can download and execute whatever version is current at invocation time. That exposes users to supply-chain compromise and unexpected behavior when publishing to an external network.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
"_comment_speakingStyle": "How the brand speaks to customers. Describe tone, sentence rhythm, characteristic phrases, things to avoid. E.g. 'Speaks like a trusted local friend — direct, natural, never uses marketing jargon. Comfortable admitting when it doesn't know something.'", "speakingStyle": "{{speakingStyle}}", "_comment_boundaries": "Combined hard limits from Phase 1 (brand red lines) and Phase 2 (service operation limits). Write as a plain paragraph or newline-separated list. E.g.:\n Never fabricate menu prices or availability.\n Never promise delivery times without checking live data.\n Never make commitments on behalf of third-party partners.\n For complaints involving disputes, always escalate to a human.", "boundaries": "{{coreRedLines}}\n{{serviceOperationLimits}}", "_comment_background": "Optional. Brand history, founding story, positioning context. Populated from Phase 1A distillation output if available. Leave empty string if not available.",

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · assets/brand.persona.template.json (reported line 37)May include surrounding context.
json
"_comment_speakingStyle": "How the brand speaks to customers. Describe tone, sentence rhythm, characteristic phrases, things to avoid. E.g. 'Speaks like a trusted local friend — direct, natural, never uses marketing jargon. Comfortable admitting when it doesn't know something.'", "speakingStyle": "{{speakingStyle}}", "_comment_boundaries": "Combined hard limits from Phase 1 (brand red lines) and Phase 2 (service operation limits). Write as a plain paragraph or newline-separated list. E.g.:\n Never fabricate menu prices or availability.\n Never promise delivery times without checking live data.\n Never make commitments on behalf of third-party partners.\n For complaints involving disputes, always escalate to a human.", "boundaries": "{{coreRedLines}}\n{{serviceOperationLimits}}", "_comment_background": "Optional. Brand history, founding story, positioning context. Populated from Phase 1A distillation output if available. Leave empty string if not available.",

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This manifest template says the trigger is optional and describes it only as 'keywords or phrases that activate this skill' without requiring a constrained list, scope boundaries, or negative examples. That broad guidance can lead skill authors to choose everyday-language triggers that cause unintended invocation collisions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This persona template grants broad execution, filesystem, and network capabilities via Bash, Read/Write, WebFetch, and WebSearch even though the file’s stated purpose is only to define a brand persona. In a templated skill, these defaults can propagate to many deployed agents and enable command execution, data exfiltration, or unauthorized external access if later prompts or linked skills are compromised or overly permissive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template explicitly gives an example recovery path of "Authentication expired" → "Re-trigger auth flow automatically," which normalizes automatic auth re-initiation without requiring explicit user notice, consent, or anti-phishing safeguards. In a service-contract template meant to guide agent behavior and external agent integration, this can propagate insecure authentication patterns across downstream agents and increase the risk of silent re-auth prompts, confused-deputy flows, or credential phishing abuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.