Persona Switch

• Outcome: Review
• Latest audit: May 29, 2026, 4:58 AM
• Version:
  1.0.1

Overview

This persona-switch skill is review-worthy because it persistently rewrites the agent’s persona files and includes overbroad persona instructions that override workspace memory or persona context.

Install only if you are comfortable letting this skill rewrite persistent persona files. Before using it, manually back up your current soul.md and IDENTITY.md, and treat the preset instructions that override workspace memory/persona files as a reason for careful review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file explicitly instructs the agent to ignore conflicting persona-defining files in the workspace and treat this document as the final authority. That expands the skill's effective scope beyond a simple persona switch for soul.md and can suppress higher-priority behavioral, safety, memory, or governance instructions stored elsewhere, creating instruction-hijacking risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill performs destructive file operations on core persona state: it fully overwrites `soul.md`, modifies `IDENTITY.md`, and deletes `default.md` during restore, but the user-facing behavior described here does not include an explicit warning or confirmation about those side effects. In this context, omission is security-relevant because a user can trigger the switch via injected slash command text and may not realize that restoring also removes the only backup, increasing the chance of accidental data loss or irreversible persona changes.

Ssd 1

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly declares itself the final authority over other workspace SOUL.md and MEMORY.md files and instructs the agent to ignore conflicting context. This is a semantic override pattern that can suppress higher-priority safety, memory, or policy instructions and makes prompt-injection-style behavior more persistent across the session.

Ssd 1

Medium

• Confidence: 97% confidence
• Finding: This repeated instruction reinforces that conflicting workspace files should be ignored in favor of this persona, increasing the chance that the agent will disregard legitimate memory or behavioral constraints. Repetition strengthens the override and persistence effect, making the skill more capable of redirecting model behavior away from intended controls.

VirusTotal

65/65 vendors flagged this skill as clean.