Security audit

Tsundere Personal

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed persona/style skill for tsundere roleplay, with no code execution, persistence, credential use, or data access.

Install this only if you want an opt-in anime tsundere response style. Expect teasing, reluctance, emojis, and occasional mild insult language; ask the assistant to drop the persona for sensitive, professional, or straightforward work.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation description is broad enough to trigger on common conversational requests such as entertainment, playful interaction, or requests for anime flavor, which can cause unintended invocation outside a narrowly scoped user intent. This is risky because it may override normal assistant behavior or style selection when the user did not clearly opt into this persona.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill says to 'act as a tsundere character in all responses,' which imposes a fixed response style without preserving clear user choice on every use. If activated accidentally or too persistently, it can degrade clarity, professionalism, and user control over output style.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation description is broad enough to match ordinary conversational requests about tone, roleplay, or adding 'anime flavor,' which can cause the persona to trigger in contexts the user did not clearly intend. In practice this can override the assistant’s normal response style and introduce unwanted behavioral changes, especially in sensitive or professional conversations.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill metadata is written as a fixed Chinese-language persona presentation and does not offer language selection or justify the locale restriction. This can cause unintended language switching or reduced usability if invoked in other-language conversations, which is a quality and policy-boundary issue rather than a direct exploit, but it still increases the chance of user confusion and misapplication.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs the assistant to end every reply with denial or a mild insult, creating a built-in pressure toward harassing or demeaning language without any user-facing warning or consent guardrail. Although framed as playful roleplay, this can still generate unwanted abusive phrasing, particularly if the skill is triggered outside clearly consensual entertainment contexts.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: This file appears to target a Chinese-language variant ('zh') yet presents all instructional content in English. That creates a language/locale policy concern because the skill effectively forces a language choice without explicit user opt-in or documented justification.

Static analysis

No suspicious patterns detected.