Persona Spawn

Spawn subagents with personas from a local workspace library or the Emblem persona marketplace. Use when a task needs a different voice, expertise, or operat...

This skill appears to do what it says: manage local personas, fetch public personas from a GitHub-hosted marketplace, assemble persona prompts, and spawn subagents. Before installing, consider: (1) personas/config.json can list shared context files; if those paths point to sensitive files (or are absolute paths), the skill will read and inject their contents into the spawned agent prompt — which may be sent to an external model provider, so avoid pointing config to secrets or private system files; (2) the marketplace importer fetches content from GitHub (raw.githubusercontent.com and a GitHub archive) — review any imported persona contents before trusting them; (3) the bundle includes example personas referencing a copyrighted character (The Mandalorian) — check licensing/policy if that matters for your org; (4) the skill writes into your workspace (personas/ and index.json), so review or sandbox those changes if you need strict file isolation. If you want to reduce risk, keep personas/config.json minimal, avoid absolute paths, and review imported persona files before using them.

Type: OpenClaw Skill Name: persona-spawn Version: 1.2.0 The skill contains a significant Local File Inclusion (LFI) vulnerability in `scripts/build-persona-prompt.py`, which reads and injects the full content of any file path specified in `personas/config.json` into the AI's prompt. While intended for 'org context,' this allows for the potential exfiltration of sensitive files (e.g., SSH keys or credentials) if the configuration is manipulated. Additionally, `scripts/import-persona.sh` downloads and extracts remote assets from a third-party GitHub repository (decentraliser/personas) without any integrity verification or checksums, posing a supply chain risk.