Security audit

Brand Persona Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent brand-agent generator, but it gives generated agents broad shell, file, and network authority by default without enough per-brand scoping.

Install only if you want an agent to generate commercial brand-agent packages. Before running it, confirm the exact output directory, review any overwrite plan, and remove unnecessary generated permissions such as shell, curl, Python, broad file access, or web access unless the specific brand service truly needs them. Treat ACN/A2A registration and any payment, order, booking, or other real-world action service as opt-in and require explicit user confirmation.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The template preauthorizes a broad set of powerful tools including shell execution, arbitrary file read/write, Python, curl, web fetch/search, and package runner access without narrowing them to a specific operational need. In a reusable persona template, this creates unnecessary attack surface and makes downstream generated skills far more capable than required, enabling command execution, data exfiltration, remote fetching, and supply-chain exposure if later prompts or configurations are compromised.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The template instructs users to keep social connectivity settings unchanged while enabling ACN and A2A external discovery/calling by default. That is risky because it normalizes outbound/inbound agent connectivity without requiring an explicit trust review, potentially exposing the agent to untrusted interactions, unintended invocation, metadata leakage, or abuse through external protocol integrations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases include broad natural-language requests such as 'generate a persona for my brand' and 'help me create a brand agent', which could plausibly appear in ordinary conversation and cause unintended activation in agents that auto-route based on fuzzy matching. In this skill's context, unintended activation is more risky because the workflow leads into file generation, service declaration, and potentially downstream command suggestions, increasing the chance of confusing or unsafe side effects from an accidental match.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly states that generation writes files and overwrites the framework default behavior guide, but it does not prominently warn users that local files will be created or replaced in the target directory. In an agentic environment, unclear overwrite behavior can lead to accidental data loss, clobbering of existing skill content, or unsafe assumptions about where generated artifacts will land.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes broad natural-language phrases such as "help me create a brand agent" and "turn my business into a persona," which are likely to appear in ordinary conversation and can activate the skill unintentionally. Because this skill can read/write files, invoke Bash, perform web searches, and orchestrate downstream skills, accidental activation could lead to unintended workflow execution, file generation, or external actions without the user clearly opting in.

Static analysis

No suspicious patterns detected.