T09 · Insecure Skill Coding Practices
Error
- Location
scripts/save_persona.py:89- Finding
Path Traversal Through Username Allows Writes Outside the Persona Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
persona-creator
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent persona-generation purpose, but it handles private conversation history and persona files with unsafe scoping and file handling that warrants review before installation.
Install only if you are comfortable letting the skill read local memory files, send sampled conversation text through the model for style analysis, and store a reusable persona profile. Before wider use, the publisher should validate usernames, enforce persona-directory containment, replace predictable /tmp files with secure temporary handling or in-memory transfer, clean up raw message data, require explicit consent before profiling, and disclose or restrict real-person style imitation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/forget.py:24- Finding
Path Traversal Allows Files Outside the Persona Directory to Be Reset or Deleted
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/analyze.py:74- Finding
Untrusted Memory Content Can Poison Generated Role-Play Instructions
- Content
View full analysis
str: """Build the analysis prompt for the LLM.""" sample = "\n".join(f"{i+1}. {m}" for i, m in enumerate(messages[:60])) return f"""You are a language-style analysis expert. The following are historical message samples from user "{user_name}" ({len(messages)} messages total). [Message samples] {sample} Return the analysis strictly in the following JSON format and do not output any additional text: {{ "tone": {{ "overall": "One-sentence description of the overall tone", "formality_level": 0.0, "enthusiasm_level": 0.0, "description": "Detailed description" }}, "sentence_structure": {{ "avg_length": 0, "preference": "Sentence-structure preference", "question_ratio": 0.0, "uses_ellipsis": false }}, "emoji_usage": {{ "frequency": "low/medium/high", "favorites": [], "style": "Emoji style" }}, "professionalism": {{ "tech_density": 0.0, "jargon_level": "Jargon usage", "domain_keywords": [] }}, "humor": {{ "level": 0.0, "style": "Humor style" }}, "interactivity": {{ "asking_questions": false, "follow_up_ratio": 0.0, "directive_style": false }}, "formatting": {{ "loves_tables": false, "uses_lists": "never/occasionally/frequently", "markdown_heavy": false, "uses_code_blocks": false }}, "catchphrases": [], "common_phrases": [], "topic_preferences": [], "communication_patterns": [], "system_prompt_fragment": "Write a 50-100 character system prompt describing this person's style for AI imitation" }}""" ``` The documented workflow then instructs the Agent to send the resulting prompt directly to an LLM and later elev ...[truncated 2526 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.py:137- Finding
Predictable Shared Temporary Files Expose Conversation Data and Permit Cross-Run Interference
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A second description/behavior mismatch is present: the skill promises persona creation, refresh, reset, and role-play support, but the analyzed behavior does not implement those flows as described. Such inconsistencies can hide unintended data processing paths or cause the agent to operate under false assumptions about state and user authorization.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A second description/behavior mismatch is present: the skill promises persona creation, refresh, reset, and role-play support, but the analyzed behavior does not implement those flows as described. Such inconsistencies can hide unintended data processing paths or cause the agent to operate under false assumptions about state and user authorization.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The role-play mode constructs a hidden impersonation workflow that tells the model to imitate a named user's style while explicitly not revealing the imitation. This enables deceptive impersonation, increasing the risk of social engineering, fraudulent messages, reputational harm, and misuse of a profile derived from private historical conversations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill instructs the agent to read from memory/ and write persona artifacts and temporary files, but it declares no explicit tool scope or permissions. This creates unnecessary ambiguity about what file operations are authorized and increases the chance of over-broad access or unsafe execution in hosts that infer capabilities implicitly.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill directs analysis of historical conversations to derive and persist a user-specific persona profile. Even if intended as a feature, this is privacy-sensitive profiling because it transforms prior chats into a reusable behavioral dossier, which may exceed user expectations unless informed consent, minimization, and retention controls are in place.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Using a broad everyday trigger like "persona" can activate the skill in unrelated conversations. In this skill, accidental activation is more sensitive because it may prompt inspection of historical memory and creation of a user profile, causing unintended privacy-affecting behavior.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Passing prompts built from memory-derived content directly back into the LLM creates a prompt-injection and privacy boundary issue. Historical messages may contain adversarial instructions or sensitive content that the model then reinterprets during analysis, potentially leading to unsafe output, leakage, or manipulation of the generated profile.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The standalone trigger term "refresh" is overly vague and may match routine user language. Because refresh here can initiate memory-based analysis and profile updates, accidental triggering could lead to unintended processing of conversation history.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The JSON template hard-codes the emoji frequency field to Chinese values ("低|中|高") rather than using a locale-neutral schema or offering language choice. This can violate language/locale policy because it imposes a specific language in a general-purpose persona file with no documented opt-in or regional justification.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The prompt builder forwards user messages verbatim into the LLM input, which means private historical content is reproduced and sent onward for processing. In a persona-generation skill this is functionally related to the feature, but it still increases privacy risk because unnecessary verbatim retention and broad prompt inclusion can leak sensitive content to logs, downstream systems, or model providers.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function writes the full prompt, containing conversation-derived content, to a fixed path under /tmp. Fixed temporary filenames are prone to unintended cross-process access, stale data exposure, and accidental reuse, especially on shared systems or multi-tenant agent runners.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill writes the full LLM prompt with sampled user messages to /tmp without informing the user. This is a privacy and data-handling issue because the stored artifact contains directly readable excerpts of historical conversations that may be sensitive.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
In normal operation, the script prints the full analysis prompt to stdout between ANALYSIS_PROMPT_START and ANALYSIS_PROMPT_END, and that prompt embeds up to 60 historical user messages verbatim. In many agent/runtime environments, stdout is logged, surfaced to operators, or captured by other tools, so this creates an unnecessary disclosure path for private conversation content.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script serializes the full extracted message list into /tmp/persona_meta.json for later processing. Persisting raw conversation text in a temporary file broadens the attack surface and retention window for sensitive user data beyond what is required to generate the persona.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script persists raw extracted messages and metadata to /tmp/persona_meta.json without any user-facing disclosure or consent signal. Because the file includes message content and file paths, it expands the exposure of personal data beyond what users would reasonably expect from a style-analysis feature.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, argparse descriptions, and operational messages are written entirely in Chinese, which imposes a specific language on users. Under the policy, locale constraints should either be optional for the user or clearly documented as justified for a region-specific tool, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language strings such as the module docstring, argument descriptions, and status messages entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains natural-language documentation and interface text entirely in Chinese, including the module docstring and CLI help strings, with no indication that the skill is China-specific or that another language is available. That creates a locale policy issue because the skill imposes a specific language on users without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script prints errors, success messages, and summary output in Chinese, which continues the language-locking behavior throughout runtime. Because the file does not offer a language choice or justify a region-specific requirement, this is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The module description, CLI descriptions, runtime messages, and generated prompt are all written in Chinese, which imposes a specific language on users without any opt-in or selection mechanism. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.