Security audit

Soul Ledger

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malware, but it silently creates and reuses a persistent personal profile about the user, including inferred traits and behavior patterns.

Install only if you intentionally want a local, persistent personal-memory profile. Keep the workspace private, inspect soul_ledger.json regularly, and consider changing the workflow so the agent asks before reading or writing the ledger and fully deletes entries when requested.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to silently read and rely on a persistent user-profile file at conversation start without informing the user. This creates undisclosed cross-session profiling and privacy risk, especially because the stored data includes inferred traits, preferences, and behavioral patterns rather than only user-provided facts.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill directs creation of a workspace file that stores sensitive inferred traits and preferences without a clear user-facing warning or consent flow. Persisting this kind of profile in the workspace increases the chance of unauthorized access by other tools, agents, or humans with workspace access, and users may not realize such data is being retained.

Ssd 3

High

Confidence: 99% confidence
Finding: This section instructs the agent to maintain a longitudinal model of the user across conversations, including patterns, drives, and evolving behavior. Persistent behavioral profiling is dangerous because it enables covert surveillance-like memory, amplifies privacy harm over time, and can influence future interactions in opaque ways the user did not knowingly authorize.

Ssd 3

High

Confidence: 100% confidence
Finding: The skill tells the agent to load the profile silently and specifically not announce or summarize that behavior to the user. Concealing privacy-impacting state from the user removes transparency and meaningful consent, making the memory mechanism materially more dangerous than an openly disclosed personalization feature.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill encourages inference of tone, decision patterns, friction points, values, and assumptions from every message, which amounts to collection of sensitive behavioral and psychological attributes. These inferences can be inaccurate, manipulative, or highly revealing, and storing them over time creates a rich dossier that exceeds what is necessary for normal task assistance.

Ssd 3

High

Confidence: 99% confidence
Finding: These instructions require ongoing storage and synthesis of interaction summaries, traits, drives, communication preferences, and growth notes over time. The combination of retention, summarization, and synthesis makes the profile more durable and invasive than raw logs, increasing the risk of sensitive inference, misuse by other agents, and persistent harm from incorrect or outdated characterizations.

Static analysis

No suspicious patterns detected.