Persona Docs

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:40 PM UTC
• Version: 0.1.0

Overview

This skill is a straightforward documentation helper for creating product persona docs, with no hidden execution or data exfiltration behavior found.

Before installing, prefer a pinned ClawHub version or a reviewed commit instead of @latest or a mutable GitHub branch. Once installed, expect the skill to read product documentation and create or update persona docs in the repository.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24
• Finding: Unpinned Remote Packages and Repository Content Executed Through npx## Vulnerability Details **File Location**: `SKILL.md:24`, `README.md:26`, and `README.md:32` **Vulnerability Type**: Supply-chain exposure through mutable, unverified remote dependencies **Risk Level**: Medium **Affected code snippets:** `SKILL.md:24`: ```bash npx clawhub@latest install persona-docs ``` `README.md:26`: ```bash npx add https://github.com/wpank/ai/tree/main/skills/writing/persona-docs ``` `README.md:32`: ```bash npx clawhub@latest install persona-docs ``` ### Technical Analysis The documented installation procedures use `npx`, which can download and execute third-party package code with the invoking user's permissions. The `clawhub@latest` reference is mutable and can resolve to a different package release after this skill has been reviewed. The GitHub installation command similarly references the mutable `main` branch rather than an immutable commit. In addition, `npx add` can resolve and execute the unpinned `add` package before processing the supplied repository URL. Consequently, the effective code executed during installation is neither contained in this audited project nor constrained to a cryptographically verified version. A malicious or compromised package release, registry account, GitHub repository, branch, maintainer account, or transitive dependency could alter the installation payload without requiring any modification to this repository. No evidence establishes that the currently referenced packages or repository are malicious. The vulnerability is the unsafe trust and execution model created by mutable, unverified external dependencies. ### Attack Path 1. An attacker compromises the relevant package registry account, package release process, GitHub maintainer account, repository branch, or a dependency used by the installer. 2. The attacker publishes malicious code under the mutable `latest` release or modifies content reachable through the `main` branch. 3. A user fo ...[truncated 1057 chars]
• Remediation: ## Remediation Suggestions 1. Replace mutable package tags such as `@latest` with a reviewed, exact version. 2. Replace the GitHub `main` reference with a full immutable commit hash or a verified signed release. 3. Pin the command runner itself rather than invoking the ambiguous, unpinned `add` package. 4. Verify package provenance, checksums, signatures, and registry ownership before installation. 5. Use lockfiles and integrity metadata where package-manager workflows support them. 6. Prefer a non-executing manual installation procedure that downloads reviewed files and verifies their checksums before copying them into the destination. 7. Document that installation should occur without administrator privileges and in an isolated environment with no production credentials. 8. Periodically review pinned dependencies and update them only after auditing the new versions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Session Persistence

Medium

• Category: Rogue Agent

Content

# Persona Docs

Create user-centered documentation that defines who a product is for and how they interact with it. Persona docs establish the foundation for product-driven development — every feature decision, design choice, and prioritization call flows from understanding your users.

## What's Inside

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The README instructs users to execute `npx add` against a remote GitHub URL without pinning a specific immutable version or commit. That allows supply-chain drift: if the upstream package or repository changes, users may unknowingly run different code than intended, including potentially malicious installer logic.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: Using `npx clawhub@latest install persona-docs` pulls and executes the latest published code at runtime, which is not reproducible and increases exposure to dependency hijacking or malicious updates. Because `npx` executes fetched packages, a compromised publisher account or package update could directly affect users running the command.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/writing/persona-docs .claude/skills/persona-docs
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/writing/persona-docs ~/.claude/skills/persona-docs
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: persona-docs
model: reasoning
version: 1.0.0
description: >
  Create persona documentation for a product or codebase. Use when asked to create persona docs,

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The installation command uses `npx clawhub@latest`, which fetches and executes the newest published package version at runtime rather than a reviewed, fixed version. If the package is compromised upstream or a breaking/malicious release is published, users running the documented command could execute untrusted code on their machine.

Static analysis

No suspicious patterns detected.