persona-seed
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes persona records from external datasets such as MatrAIx Persona 1M and Nemotron Personas USA. This creates an attack surface where malicious content embedded in the source datasets could potentially influence the behavior of the agent during the generation process.
- Ingestion points: Data is loaded from files specified in environment variables (
MATRAIX_CORPUS_PATH,NEMOTRON_CORPUS_PATH) via the provider modules. - Boundary markers: The current implementation of
map-seed-to-persona.jslacks explicit semantic boundaries or instructions to the agent to disregard potential instructions found within the corpus text. - Capability inventory: The skill uses
Bash,Read,Write, andEdittools to execute search, mapping, and generation scripts. - Sanitization: The skill performs structural mapping and basic slugification, but does not semantically sanitize descriptions or persona traits retrieved from external files.
- [EXTERNAL_DOWNLOADS]: The skill provides a shell script
decode-matraix.shthat uses thehuggingface-clito download datasets from Hugging Face. This is a standard and neutral feature for a tool designed to work with population corpora. - [COMMAND_EXECUTION]: The skill utilizes shell commands and a Python script (
decode_parquet.py) to decode and transform Parquet shards into a processable JSON format, which is an expected part of its data processing pipeline.
Audit Metadata