Security audit

Hersona

Security checks for vulnerabilities and agentic risk

Overview

This persona skill is coherent, but it deserves Review because it can persist agent behavior and user-provided memory while also documenting a few risky shell and git workflows.

Install only if you are comfortable with a skill that changes persona/system-prompt behavior and can persist profile state across sessions. Avoid putting secrets, private conversation text, credentials, or sensitive personal data into --memory or --memory-file. Review SOUL.md and config.yaml changes before and after persistent/reset operations, and do not run the documented eval or git reset --hard recipes without safer verification and backups.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: REFERENCE.md:324
Finding: Unpinned Third-Party Package Output Is Evaluated by the Shell
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:303
Finding: Destructive Git Recovery Command Can Erase Local Work
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: The skill documentation recommends git reset --hard origin/main, a destructive command that discards uncommitted local changes. In an agent-assisted context, surfacing such commands without strong safeguards can lead to accidental data loss if executed by a user or another automation path based on the skill's instructions.
Content: Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.
md
rewrites main's history with force-push (confirmed 2026-06-15). If symptoms appear such as `hersona list` showing fewer than expected / Hiroshima-ben not visible, check `git fetch --dry-run` for `(forced update)`. If present, sync with `git reset --hard origin/main`. 9. **`/hersona` not interpreted on a chat platform** — on Telegram / Discord etc., `/hersona` does not reach the LLM. Instead, call the `hersona` CLI directly and

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The primary skill reference title and the document body are written in Japanese, making the operational guidance effectively Japanese-only for readers of this file. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy violation unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises broad, natural-language trigger phrases like everyday requests to 'talk like' or 'act as' a persona without clearly separating informational mention from activation. In agent frameworks that auto-route on loose semantic matching, this can cause unintended persona attachment and system-prompt modification without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documented memory feature stores recent user-provided context into SOUL.md for automatic reuse in future sessions, creating a persistence channel for potentially sensitive information. Even with size limits and markdown escaping, this can retain personal, confidential, or instruction-like content beyond the original session scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The mode descriptions introduce persistent registration and reset behavior, but the warning about cross-session writes and deletion effects is not sufficiently prominent at the point of use. Users could unknowingly cause lasting profile changes or clear stored persona state when they intended a session-only experiment.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
- Injects `core_traits` / `catchphrases` / `tone` / `description_ja` from `attributes/personality/tsundere.yaml` into the system prompt - Lists related attributes via `compatible_archetypes` (for the LLM to reference) - Does **not** write to the persona registry - Reverts automatically when the session ends #### multi

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The --memory and --memory-file guidance encourages operators to copy arbitrary recent context into persistent persona state, which may silently propagate user data or injected instructions across future sessions. Persistence increases the blast radius because data survives conversation boundaries and can influence later model behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The reset section states it 'Deletes all attributes registered in persistent mode from config.yaml' and performs an automatic backup, implying direct automatic config.yaml modification. Earlier persistent-mode documentation explicitly says automatic writing to config.yaml is not performed and that registry writes are delegated through framework APIs to avoid YAML-corruption pitfalls, creating an active contradiction in documented intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.