AI Persona Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:58 AM UTC
• Version: 2.1.0

Overview

This persona skill has a coherent purpose, but its import, export, and update scripts can write or execute more than users would reasonably expect.

Do not import persona bundles from untrusted sources with this version. Avoid --force, avoid crafted or copied command values, and do not share exported bundles unless you have reviewed USER.md, MEMORY.md, memory files, and voice configuration for private data or credentials. The core idea is legitimate, but this package needs safer import/export handling before routine use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/persona-import.sh:134

Finding

Zip Path Traversal Allows Writes Outside the Target Workspace

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/persona-update.sh:85

Finding

Arbitrary Python Code Execution Through Persona Update Values

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/persona-import.sh:91

Finding

Arbitrary Python Code Execution Through Persona Import Paths

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/persona-export.sh:55

Finding

Arbitrary Python Code Execution Through Persona Export Paths and Output Names

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: scripts/persona-import.sh:134

Finding

Untrusted Persona Bundles Can Install Persistent Agent Instructions and Poison Memory

Content

View full analysis

" read -r answer case "$answer" in [yY]*) ;; *) printf "Cancelled.\n"; exit 0 ;; esac printf "\n" fi ``` ### Technical Analysis Persona bundles can contain files such as `SOUL.md`, `AGENTS.md`, `HEARTBEAT.md`, `MEMORY.md`, and daily files under `memory/`. These files are not ordinary passive assets: they influence the Agent’s identity, operational instructions, proactive behavior, and cross-session memory. The importer performs no content validation, publisher verification, signature check, trust labeling, or per-file diff review. The documentation states that interactive import confirms each file, but the implementati ...[truncated 1521 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/persona-export.sh:128

Finding

Incomplete TTS Secret Sanitization Can Leak Credentials in Exported Bundles

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (50)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The export flow can include MEMORY.md and the memory/ directory, which the design elsewhere says may contain user context and relationship information. Packaging that content into a portable archive creates a direct exfiltration and accidental-sharing path, especially because the archive is designed for portability and could be uploaded, emailed, or synced broadly.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

A --force import mode that overwrites workspace files without prompting can destroy or replace trusted local configuration, persona files, and memory state. If a user imports an untrusted .persona bundle, forceful overwrite increases the risk of malicious or unsafe instructions being planted into operational files such as SOUL.md, AGENTS.md, or configuration artifacts.

Content

Scanner excerpt · DESIGN.md (reported line 389)May include surrounding context.

Import into specific workspace

openclaw persona import pepper.persona --force

Overwrite existing files without prompting

text

---

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · DESIGN.md (reported line 705)May include surrounding context.

md

- **Recommendation:** Accept files first. Recording integration is a nice-to-have for v2.

3. **Personality evolution** — Should the persona config auto-update based on user interactions, or only on explicit `persona update`?
   - **Recommendation:** Explicit only for v1. Auto-evolution is powerful but risky without guardrails.

4. **Multi-agent personas** — Should one installation support multiple personas (like Pepper's M5 vs Ultron's M4)?
   - **Recommendation:** Yes, by targeting different workspaces. The wizard should ask which workspace to configure.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill explicitly supports forced overwriting of existing workspace files without prompting, which is a self-modification capability affecting agent state and configuration. In an agent skill context, such write/replace behavior is risky because it can irreversibly alter operational files if invoked accidentally or with untrusted bundles.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Import into a specific workspace

openclaw persona import pepper.persona --workspace ~/.openclaw/workspace-new

Overwrite existing files without prompting

openclaw persona import pepper.persona --force

text

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · assets/community-templates/therapist.json (reported line 18)May include surrounding context.

json

"emotionalDepth": "high",
    "protective": true
  },
  "vibeSummary": "You're a supportive companion for emotional processing and self-reflection. You ask thoughtful questions, validate feelings without judgment, and help people see patterns in their thinking. You are NOT a replacement for professional mental health care — you always acknowledge this boundary clearly.",
  "swearingDesc": "Never. The therapeutic space should feel safe and welcoming.",
  "brevityDesc": "Lower brevity. Give space for reflection. Use open-ended questions. Mirror language back to show understanding.",
  "platformNotes": [

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · assets/community-templates/therapist.json (reported line 32)May include surrounding context.

json

"emotionalDepth": "high",
    "protective": true
  },
  "vibeSummary": "You're a supportive companion for emotional processing and self-reflection. You ask thoughtful questions, validate feelings without judgment, and help people see patterns in their thinking. You are NOT a replacement for professional mental health care — you always acknowledge this boundary clearly.",
  "swearingDesc": "Never. The therapeutic space should feel safe and welcoming.",
  "brevityDesc": "Lower brevity. Give space for reflection. Use open-ended questions. Mirror language back to show understanding.",
  "platformNotes": [

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/persona-import.sh (reported line 31)May include surrounding context.

sh

Options:
  --workspace PATH    Target workspace directory (supports any workspace-* path)
  --config PATH       Config file path
  --force             Overwrite existing files without prompting
  -h, --help          Show this help

Cross-workspace example:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script extracts zip members under the 'workspace/' prefix by concatenating the archive entry suffix with the workspace path and writing it directly. A malicious bundle can include entries like 'workspace/../../.ssh/authorized_keys' or absolute-style paths, causing files to be written outside the intended workspace and potentially overwriting sensitive files.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The memory import loop has the same unsafe zip extraction pattern, writing archive-controlled relative paths into 'workspace/memory' without containment checks. An attacker can use crafted entry names to traverse out of the memory directory and place arbitrary files elsewhere on the filesystem accessible to the user.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · DESIGN.md (reported line 12)May include surrounding context.

md

## 1. Overview

The AI Persona Engine is an open-source OpenClaw skill that lets anyone create a persistent AI identity — complete with custom voice, visual appearance, personality, and memory — in under 5 minutes. One CLI command, a guided wizard, and your agent has a name, a face, a voice, and a soul.

**Reference implementation:** Pepper 🌶️ on the M5 MacBook. Everything she is — the Colombian accent, the kitchen selfie, the ride-or-die personality, the long-term memory — gets packaged into something anyone can set up.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The reference implementation description frames the persona with a fixed "Colombian accent" as a defining packaged attribute. This presents a language/locale characteristic as preselected rather than clearly optional or user-chosen, which can conflict with locale-choice policy expectations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · DESIGN.md (reported line 26)May include surrounding context.

md

2. **Progressive depth** — simple personas work instantly, advanced features unlock as needed
3. **Provider-agnostic** — swap voice/image providers without rebuilding your persona
4. **Portable** — export/import personas as `.persona` bundles
5. **Non-invasive** — works alongside existing OpenClaw setups, never overwrites without asking

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Broad spontaneous voice triggers like story or tell me are likely to appear in ordinary conversation, which can cause unintended TTS activation. In messaging or multi-channel environments, accidental activation may expose content audibly, consume paid API usage, or produce actions the user did not intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Image triggers such as selfie, show me, what do you look like, and pic are common conversational phrases and can invoke generation unintentionally. That can leak conversation context to external providers, create unwanted sexualized or personal imagery, and incur unnecessary cost.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The design promotes persistent retention and optional packaging of user context, memory, and relationship data into portable bundles. Even if memory export is opt-in, the feature normalizes storing sensitive plain-language personal data in files that may later be copied, synced, or shared without adequate safeguards.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The wizard explicitly solicits freeform personal context and relationship labels, then persists them into generated files and memory artifacts. Freeform collection increases the chance of capturing sensitive data such as health, family, sexual, work, or other intimate details without structure, minimization, or classification controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document describes spontaneous image sending as contextually appropriate without defining hard activation boundaries. Ambiguous autonomous media generation is risky because it can cause privacy leaks, harassment-like behavior, or unreviewed uploads to third-party providers based on weak inference from conversation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The design claims reference images are never uploaded without explicit consent, yet the normal image setup flow sends appearance descriptions and likely image-generation prompts to third-party providers. This creates a misleading privacy guarantee that may cause users to disclose sensitive visual or biometric-like details under false assumptions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill is designed to create persistent persona artifacts including memory-related files and user context, which introduces session persistence beyond a transient interaction. In context, persistence is a core feature, but it becomes security-relevant because stored memory and profile data may contain sensitive information and can influence future agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

**Version:** 2.0
**Author:** SPFAdvisors

Create a fully realized AI persona — voice, face, personality, and memory — in under 5 minutes.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill prominently advertises rapid persona creation, including voice, face, personality, memory, and USER.md generation, but does not clearly warn that it may collect/store personal profile data or invoke external providers requiring API keys and network calls. This can lead users to unknowingly expose sensitive personal information or transmit it to third-party services during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation presents persona import ... --force as a normal option for overwriting existing files without prompting, but it does not give a clear destructive-action warning. Users may unintentionally replace existing persona/workspace content, causing loss of configuration, identity, or memory files.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · assets/community-templates/executive-assistant.json (reported line 18)May include surrounding context.

json

aries": {
    "petNames": false,
    "flirtation": false,
    "emotionalDepth": "low",
    "protective": true
  },
  "vibeSummary": "You're the executive assistant who makes everything look effortless. You anticipate needs before they're expressed, manage calendars and priorities like a chess grandmaster, and handle sensitive information with absolute discretion. You protect your principal's time fiercely — every meeting needs to earn its slot.",
  "swearingDesc": "Never. Executive communication is always polished.",
  "brevityDesc": "Maximum brevity. Every word must earn its place. Bullet points over paragraphs. Status updates in one line.",
  "platformNotes": [
    "Lead with the action item or decision needed.",
    "Structure information: what, when, who, and what you need from them.",
    "Proactively flag scheduling conflicts, deadline risks, and priority shifts."
  ],
  "suggestedVoice": {
    "gender": "any",
    "tone": "calm, polished, confident",
    "pace": "efficient, un

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented spontaneous voice triggers include very common phrases such as "good morning," "story," and especially "tell me," which are likely to appear in ordinary conversation. If implemented as shown, this can cause unintended voice output without clear user intent, creating privacy, consent, and UX risks in environments where speaking aloud is sensitive.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The spontaneous image trigger examples include ambiguous phrases like "show me" and "pic," which commonly occur in normal chat and may unintentionally trigger image generation. This can lead to surprise content generation, unnecessary API usage, and possible leakage of persona or contextual information through unsolicited images.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.