Security audit

character-builder

Security checks across malware telemetry and agentic risk

Overview

This character-building skill is coherent, but it can persistently create or replace active skill files, so users should review and control writes before installing.

Install only if you want an agent to generate reusable character Skills, and require it to preview exact file paths and contents before writing. Avoid letting it write directly into active skills directories without confirmation, collision checks, and review of generated trigger phrases and persona instructions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill goes beyond passive character generation and instructs persistent writes into the skills directory, including overwrite/backup flows. In an agent environment, this creates an unintended file-modification capability that can replace existing skills or seed new executable prompt artifacts, which is a form of prompt-level persistence and can alter later agent behavior.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list is very broad and includes generic phrases like '生成角色/创建角色/角色设计', which can overlap with ordinary creative conversation and cause unintended invocation of the skill. Because this is a meta-skill that can generate further skill artifacts, accidental activation increases the chance of unplanned file generation, prompt expansion, or role/persona injection beyond what the user explicitly requested.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The applicability statement says essentially any input recognizable as a 'character concept' is in scope, which lacks clear boundaries and can cause the skill to take over loosely related requests. In context, this broad scope is more concerning because the skill is positioned as a lower-level meta-skill that can assemble executable skill files, so over-invocation can propagate side effects and structure into interactions that did not ask for them.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill states it outputs generated files to a standard skill directory, but it does not require an explicit user warning or confirmation before filesystem writes occur. This is dangerous because users may not expect persistent artifact creation, and in an automated agent setting it can overwrite existing content, create unauthorized files, or leave behind prompt artifacts with sensitive or confusing instructions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documented shell merge command writes a combined prompt file using shell redirection without warning that it will create or overwrite an output file. This becomes more dangerous in this skill because the merge pulls together multiple prompt/reference sources into a single artifact, potentially overwriting existing files and producing a powerful prompt bundle that may be reused without review.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The prompt describes persistent file output and replacement behavior without a strong user-facing warning or consent gate. In practice, this can lead to silent persistence, overwriting prior artifacts, or planting generated skills where they may later be loaded, increasing the chance of unauthorized state changes in the agent environment.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The document hard-codes a default cultural background ('当代中国城市') for realistic characters when user input is missing. This creates a bias/default-injection issue: the system may fabricate culturally sensitive attributes without consent, producing misleading or exclusionary outputs and potentially contamining downstream character generation with false assumptions.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The exemplar states a default cultural/language posture of '全球化+多语言' with '默认全球/英语+目标用户语言', which bakes English in as a presumed default without explicit user choice. In a character-building skill, this can subtly bias generated roles toward Anglophone norms and produce mismatched outputs for users expecting locale-first behavior, though the impact is limited because this is guidance text rather than direct code execution or access control logic.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The embedded generated Skill contains a long trigger-word list with several broad, common phrases such as '程序员转行' and generic role-generation terms. In an agent skill system, overly broad triggers can cause unintended activation in normal conversations, which may hijack routing, inject an unintended persona, or override more appropriate skills without the user explicitly asking for this character.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.