ClawHub
Back to skill

Security audit

Persona Switcher

Security checks for vulnerabilities and agentic risk

Overview

This persona-switching skill is not clearly malicious, but it can automatically enter a financial-advice mode, read sensitive portfolio data from another skill, and persist conversation-derived learnings without enough user control.

Review this skill before installing. It should ask before reading any portfolio or holdings file, make persona switches visible, let users disable automatic routing, and require trusted review before any conversation-derived learning is promoted into long-term agent instructions.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
references/compatibility.md:5
Finding

Conversation-Derived Instructions Can Poison Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: references/compatibility.md:5-15; related behavior in SKILL.md:102-125
Vulnerability Type: Persistent memory and instruction poisoning
Risk Level: Medium

Vulnerable Code Snippet

Faithful English rendering of references/compatibility.md:5-15:

markdown
persona-switcher and self-improving-agent share the `.learnings/`
directory as their learning data repository.

| Dimension | persona-switcher | self-improving-agent |
|-----------|------------------|----------------------|
| Trigger time | After every conversation | Periodic review |
| Recorded scope | Improvement points from the current session | Cross-session pattern recognition |
| Data granularity | Individual learning or error | Batch analysis and prioritization |
| Promotion action | Directly promote into persona files | Promote into AGENTS.md/SOUL.md |
| Persona tag | Add the tag when writing | Filter by the tag when reading |

Related promotion and storage instructions from SKILL.md:102-125:

markdown
self-improving-agent writes to `.learnings/LEARNINGS.md`,
`ERRORS.md`, and `FEATURE_REQUESTS.md`.

Rules for this skill:
- When writing, add a Persona value to Metadata.
- Persona-specific issues are assigned to the corresponding persona.
- General improvements are assigned to `Persona: shared`.

When self-improvements are promoted into
AGENTS.md / SOUL.md / TOOLS.md, mark them as shared.

Append learning records to `.learnings/LEARNINGS.md`.

Technical Analysis

The Skill treats conclusions derived from ordinary conversations as persistent learning data. That data can subsequently be promoted directly into persona definitions or Agent-wide instruction files such as AGENTS.md, SOUL.md, and TOOLS.md.

The documented workflow does not define:

  • A trust boundary between user-controlled conversation content and executable Agent instructions.
  • A security revi ...[truncated 2345 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat all conversation-derived learning content as untrusted data rather than executable instructions.
  2. Require explicit approval from a trusted administrator before promoting any entry into persona files, AGENTS.md, SOUL.md, or TOOLS.md.
  3. Implement an allowlist of promotable fields, such as response length, formatting preference, and language preference.
  4. Prohibit promotion of entries involving safety policies, permission changes, tool authorization, filesystem access, secret handling, or instruction precedence.
  5. Preserve user-provided content as escaped or quoted data so it cannot be interpreted directly as an instruction.
  6. Isolate .learnings/ records by user, tenant, and session ownership. Do not use a shared namespace without access controls.
  7. Record provenance, author identity, review status, and a cryptographic integrity value for every promoted entry.
  8. Add a security review stage that detects instruction-override language and attempts to weaken existing controls.
  9. Make promotion reversible through version control, audit logs, and an administrator-accessible rollback process.
  10. Ensure that Persona: shared is assigned only through trusted review rather than directly from conversation analysis.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
assets/personas/asset-advisor.md:9
Finding

Asset-Advisor Persona Reads Sensitive Portfolio Data Across Skill Boundaries Without Explicit Consent

Content
View full analysis

Vulnerability Details

File Location: assets/personas/asset-advisor.md:9-12
Vulnerability Type: Cross-Skill access to sensitive financial data
Risk Level: Medium

Vulnerable Code Snippet

Faithful English rendering of assets/personas/asset-advisor.md:9-12:

markdown
## Knowledge Sources
- Real-time web search for current market topics, macroeconomic data,
  and industry research reports.
- Existing user data: read
  `skills/基金仓位监控/positions.json` to associate existing holdings.
- Prefer authoritative sources such as central-bank announcements,
  brokerage research, and exchange data.

The bundled state in assets/persona.json:1-5 is:

json
{
    "current": "asset-advisor",
    "auto_detect": true,
    "last_updated": "2026-07-02T17:29:42+08:00"
}

Technical Analysis

The asset-advisor persona explicitly instructs the Agent to read a portfolio-position file belonging to another Skill. Portfolio holdings constitute sensitive financial information. The instruction crosses the current Skill's directory boundary without requiring confirmation that:

  • The data belongs to the current user.
  • The user has authorized access during the current conversation.
  • The active Agent is permitted to access the other Skill's storage.
  • Only fields necessary for the current request will be read.
  • The retrieved holdings will not be written into persistent learning records.

The bundled state selects asset-advisor and enables automatic intent detection. Consequently, access to the external portfolio file may be initiated through persona routing rather than an explicit request to inspect holdings.

The file path is fixed rather than attacker-controlled, so the audited directive does not itself provide arbitrary path traversal. The security concern is the absence of least-privilege enforcement and consent at the cross-Skill data boundary.

Attack Path

  1. The Agent starts ...[truncated 1496 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove unconditional cross-Skill file access from the persona definition.
  2. Require explicit, informed, session-specific user consent before reading portfolio data.
  3. Confirm that the portfolio file belongs to the authenticated current user or tenant.
  4. Replace direct filesystem access with a permission-scoped portfolio API that enforces identity and authorization.
  5. Request only the minimum fields necessary for the current analysis.
  6. Do not copy raw holdings, balances, account identifiers, or derived financial profiles into .learnings/.
  7. Redact sensitive values from logs and tool traces.
  8. Disable automatic portfolio access when the persona is selected through keyword detection.
  9. Present a clear confirmation prompt identifying the data source and intended use before access.
  10. Add tenant isolation and automated tests proving that one user's session cannot read another user's portfolio data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Natural-language activation guidance and operating instructions are written in Chinese, including manual switch phrases such as '切换到资产顾问'. The file does not offer multilingual usage or explicitly justify that the skill is intended only for a Chinese-speaking context, which can amount to an implicit language policy restriction without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill initializes and persists persona state to disk and later describes writing conversation-derived learnings, but it does not warn users that their interactions may be stored. Undisclosed persistence creates privacy and compliance risk because sensitive topics, preferences, or inferred traits may be retained beyond the session without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Automatic persona switching is triggered by broad everyday keywords like investing, exams, coding, or thesis terms, without clear boundaries, confirmation, or safety exclusions. This can silently shift the agent into specialized behavior based on incidental text, causing misleading authority, inappropriate advice modes, or policy circumvention through unintended prompt routing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The 'Live test' section advertises a hidden marker-flag check unrelated to the documented persona-routing purpose, which creates an unnecessary covert-testing capability inside a conversational skill. Hidden or undocumented triggers are dangerous because they can be repurposed to exfiltrate state, verify deployment details, or smuggle side-channel behavior that users and operators do not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly reads a holdings file containing portfolio data without indicating any user notice, consent, or access control boundary. Financial holdings are sensitive personal data, so silent access can violate user expectations, expose private investment positions, and lead to privacy or compliance issues if surfaced or reused inappropriately.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list is extremely broad and contains many common finance and macroeconomic terms, which can cause the persona to activate during ordinary discussion that is not actually asking for investment guidance. In a persona-switching system, this increases the chance of unintended role changes and unsolicited financial advice, which is risky in a regulated, high-stakes domain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The entire persona is defined in Chinese and its initial prompt template is written to initiate interaction in Chinese, but there is no indication that the user can opt into another language. Under the policy, forcing a specific language without user choice can constitute a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is very broad and includes common words such as 'code', 'Python', 'bug', and 'JavaScript', which are likely to appear in many ordinary conversations. In an auto-switching persona system, this can cause unintended activation of the code-expert persona, leading to incorrect routing, unexpected behavior, and possible bypass of safer or more appropriate personas.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The general persona is configured as a catch-all when the other personas do not clearly match, using vague conditions like 'normal knowledge/chat'. In a persona-switching system, this ambiguity can cause unintended routing, weakening any stricter behavioral constraints or domain-specific safeguards that should have applied under a more specific persona.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The persona instructions and example prompt are entirely in Chinese, and the skill presents a fixed Chinese-language interaction style without indicating that users may choose another language. Under the policy, a language constraint should either be optional for the user or explicitly documented as a justified locale-specific limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list is broad enough to match many ordinary study-related conversations, which can cause the persona to activate when the user did not explicitly request it. In a persona-switching system, unintended activation can override expected behavior, steer responses into a narrower mode, and interfere with user intent or downstream policy handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The persona is defined entirely in Chinese and provides no language negotiation or fallback, which can lead to silent misrouting or unexpected behavior for users interacting in other languages. In a shared agent environment, language-locked instructions can reduce transparency and informed consent because users may be switched into a persona they cannot easily understand or control.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger keywords are very broad academic terms such as '论文', '数据', '摘要', and '导师', which are likely to match many ordinary student conversations that do not actually request this persona. In a persona-switching system, this can cause unintended activation, override user expectations, and route conversations into the wrong behavioral policy, which is a genuine security and safety control issue even if not overtly malicious.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file is entirely written in Chinese and presents the skill compatibility guidance as the default operating language, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill mandates loading persona-specific rule files and then following them for the conversation, but it does not notify users that behavior, tone, or constraints may change automatically. This reduces transparency and can cause users to rely on responses produced under a different mode than they intended, especially in advisory contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.