persona-seed

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes persona records from external datasets such as MatrAIx Persona 1M and Nemotron Personas USA. This creates an attack surface where malicious content embedded in the source datasets could potentially influence the behavior of the agent during the generation process.
  • Ingestion points: Data is loaded from files specified in environment variables (MATRAIX_CORPUS_PATH, NEMOTRON_CORPUS_PATH) via the provider modules.
  • Boundary markers: The current implementation of map-seed-to-persona.js lacks explicit semantic boundaries or instructions to the agent to disregard potential instructions found within the corpus text.
  • Capability inventory: The skill uses Bash, Read, Write, and Edit tools to execute search, mapping, and generation scripts.
  • Sanitization: The skill performs structural mapping and basic slugification, but does not semantically sanitize descriptions or persona traits retrieved from external files.
  • [EXTERNAL_DOWNLOADS]: The skill provides a shell script decode-matraix.sh that uses the huggingface-cli to download datasets from Hugging Face. This is a standard and neutral feature for a tool designed to work with population corpora.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands and a Python script (decode_parquet.py) to decode and transform Parquet shards into a processable JSON format, which is an expected part of its data processing pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 01:55 AM
Security Audit — agent-trust-hub — persona-seed