Security audit

Soul architect

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Review case because it asks agents to build personas from sensitive psychological and rumor-based research without clear safeguards.

Install only if you are comfortable with a skill that researches and synthesizes sensitive persona profiles. Avoid using it on private or living people without consent, verify sources carefully, treat psychological or diagnosis-like claims as untrusted speculation, and constrain persona names to safe characters before running the helper script.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/synthesize.py:20
Finding: Path Traversal Through Unvalidated Persona Name
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: scripts/synthesize.py:33
Finding: Agent Instruction Injection Through Untrusted Console Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 33)May include surrounding context.
text
*.log # Environment .env .env.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 34)May include surrounding context.
text
# Environment .env .env.local

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: soul-architect description: Call when creating/updating STYLE_MANIFESTO persona source code. --- # Soul Architect 🧠🏗️ This skill creates the "Identity Manifesto" that drives the `content-engine`. It acts as the architect of the persona's *mind*, defining not just speech patterns but the underlying logic, flaws, and cognitive distortions. **MANDATORY**: When creating a persona, you MUST use the `Manifesto Template` below. Do not invent your own structure. ## 🕵️‍♂️ God Tier Research Protocol (Search Queries) Do not just search for "biography". You must run **at least 6 specific queries*

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to research and synthesize highly sensitive psychological, trauma-related, and potentially defamatory attributes such as childhood wounds, diagnoses, breakdowns, and controversial opinions. That creates privacy, reputational, and profiling risk, especially for living persons, because it encourages collection of speculative or unverified personal data without consent, necessity limits, or safety disclaimers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The template mandates a fixed English structure with headings and fields such as 'STYLE & COGNITIVE MANIFESTO' and 'Do not invent your own structure,' but nowhere offers a language or locale option. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.