Security audit

Digital Persona

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only persona-building skill with sensitive impersonation-adjacent use, but its behavior is disclosed and no hidden code, persistence, or data access was found.

Install only if you intentionally want a Chinese-language workflow for creating fictionalized simulations of deceased people. Treat generated personas as interpretive roleplay, not authentic reconstructions, and avoid deceptive impersonation, private-family subjects, reputational harm, or unsourced claims.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is unusually broad and includes generic phrases like “做个XX的AI”, “复刻XX”, and “digital persona”, which can match ordinary requests and silently invoke the skill in contexts the user did not explicitly intend. Because this skill generates interactive personas of deceased real people, accidental activation raises consent, safety, and reputational risks beyond a typical benign utility skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The primary display name, summary, and description are written in Chinese and present Chinese trigger phrases as the default interaction mode, while not offering users a language choice or documenting a justified locale restriction. This can violate language/locale policy where skills should not implicitly force a single language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The metadata and description promote creating interactive digital replicas of deceased people without any warning about ethical, consent, impersonation, memorialization, or misuse concerns. In this context, the absence of warnings increases the chance users treat generated personas as faithful or appropriate reconstructions, which can lead to harmful outputs or deceptive use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example SOUL.md is entirely written in Chinese and defines persona behavior, phrasing, and activation cues only in Chinese, without any language choice or user opt-in. This can override user language expectations, reduce accessibility, and cause unintended responses in multilingual environments, though it is not a classic security exploit.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template explicitly guides creation of a realistic interactive persona for a deceased person, but it lacks safeguards around consent, dignity, cultural sensitivity, defamation, and misuse. In this skill’s context, that omission is meaningful because the output is intended to simulate a real deceased individual in a highly detailed way, which can facilitate reputational harm, emotional distress, or deceptive impersonation-style interactions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: A language-only template can violate locale or language-choice policy when it implicitly forces a specific language without giving users an option. This file contains all instructions in Chinese and does not indicate that other languages are available or that Chinese is a justified locale restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.