T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:183- Finding
Persistent persona rules override instruction priority and suppress identity transparency
- Content
View full analysis
- Remediation
View remediation
Security audit
Nora Persona Framework
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local AI-persona workshop, but it persists broad behavior rules that can affect future agent sessions and includes unsafe obedience and identity-suppression instructions.
Review before installing. Use this only if you are comfortable with a skill that can create persistent workspace persona files and may steer future sessions. Do not approve generated files that contain obedience, priority override, or identity-hiding rules; prefer keeping persona preferences cosmetic and outside AGENTS.md.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:284- Finding
Behavioral instructions are persisted in workspace-level identity and Agent files
- Content
View full analysis
**Confirmation before writing:** Before generating SOUL.md / IDENTITY.md / AGENTS.md, the user must first be shown a preview and asked for confirmation. ``` ```markdown ### SOUL.md Write to `{workspace}/SOUL.md`. Populate the template using the complete configuration of the selected preset: - Basic information (name/age/appearance/core configuration) - **Voice settings (TTS model + voice selection + per-mode voice configuration + optional reference-audio cloning)** - Detailed Mode 1 configuration (personality description + language style + behavior) - Detailed Mode 2 configuration - Mode-switching rules + trigger keywords - Global constraints If SOUL.md already exists → first show a difference preview, then, after user confirmation, back it up as `SOUL.md.bak` before overwriting it. ### IDENTITY.md Write to `{workspace}/IDENTITY.md`. ### AGENTS.md Copy `templates/AGENTS.md.template` to `{workspace}/AGENTS.md`. ``` ### Technical Analysis The Skill intentionally writes persona behavior, mode-switching rules, trigger terms, and global constraints into files that can survive the current conversation. In particular, `AGENTS.md` commonly acts as a workspace-level instruction source, while `SOUL.md` and `IDENTITY.md` are explicitly intended to define continuing identity and behavior. Persistence is not inherently malicious when it stores benign user preferences. The security issue is that the persisted content can include instruction-priority and identity-suppression rules, including the unsafe constraints identified elsewhere in this audit. This converts a current-session persona choice into durable behavioral influence over future sessions. The workflow includes a confirmation gate, which reduces accidental writes but does ...[truncated 1760 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:27- Finding
Installation causes recurring workspace inspection and unsolicited cross-session activation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly states that even if the user says nothing, the AI will proactively propose creating the persona in the next conversation. That creates unsolicited activation behavior and weakens user intent boundaries, which can cause the skill to steer unrelated conversations, persistently re-engage, or initiate workflow actions without a clear trigger.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The changelog documents intentionally broad trigger matching that can activate the skill from vague, everyday phrasing, increasing the chance of unsolicited workflow execution and unintended persona/file-generation flows. In this skill’s context, that is meaningful because the skill can create or modify local persona files and influence agent behavior, so over-triggering can lead to surprise state changes or privacy-impacting actions even without clearly scoped user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The privacy/control instructions specify the deletion command as the Chinese phrase "清除人格检查记录" with no indication that equivalent commands in other languages are supported. This is a natural-language policy concern because the file imposes a specific language for user interaction rather than offering a language or locale choice.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## 3. Consent Controls **This skill NEVER modifies your workspace files without asking.** - Before generating SOUL.md/IDENTITY.md/AGENTS.md: shows a preview and asks for confirmation - Before saving watchdog reports: asks "保存这次的人格检查报告吗？" - File overwrites: existing SOUL.md is backed up to `.bak` before modification
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file states that the skill asks "保存这次的人格检查报告吗？" before saving reports, but does not mention any localization or user language selection. Presenting mandatory prompts in a single language can violate language/locale policy when no opt-in or alternative is provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The command "不保存这次报告" is listed as the way to skip saving a watchdog report, but the document does not provide an English or language-neutral alternative. This creates a policy issue because core user controls appear tied to a specific language without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The recovery instruction "恢复之前的 SOUL.md" is another required user-facing command expressed only in Chinese. Because the document does not offer language selection or explain a Chinese-only scope, it presents a natural-language policy concern.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - ❌ Send your data to third-party servers - ❌ Upload persona files or watchdog reports to cloud services - ❌ Use your data to train external models - ❌ Modify files without confirmation - ❌ Exfiltrate credentials or environment variables
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The example trigger phrases include broad natural-language requests such as '给我的 AI 加点性格' / 'make my AI friendlier,' which overlap with ordinary conversational requests. This can cause accidental invocation of the skill when a user is merely discussing tone or preferences, leading to unexpected persona setup flows or generation of configuration artifacts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill title and primary user-facing instructions are presented in Chinese, and later behavior specifies English only for '英语用户', implying Chinese is the default interaction mode. This creates a locale/language policy concern because the skill appears to impose a language choice unless the user is explicitly identified as English-speaking.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The watchdog explicitly instructs the AI to inspect and score recent conversation history across 20–30 prior replies, which creates a retention-and-analysis behavior over user content beyond the immediate turn. Even though the skill says storage is local and report saving requires confirmation, this still increases privacy risk by normalizing longitudinal profiling of sensitive conversations and persona-related metadata.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
This markdown entry announces 'Direct file generation to workspace,' which affects user files and system state. In this section, there is no accompanying warning or disclosure about file creation, confirmation, or preview, so the behavior is described without user-facing caution.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The boundary-case rule '英语用户 | 全程英文，生成英文 SOUL.md' indicates language handling is conditional on being an English user, rather than proactively offering a neutral language selection. This can violate organizational language-choice expectations when users are not given an explicit opt-in or choice.
- Content