Soulstamp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:48 AM UTC
• Version: 1.0.2

Overview

This skill is a coherent creative persona tool, but it deliberately creates persistent agent identity instructions and includes ambiguous permission framing and local file overwrite actions that users should review carefully.

Install only if you intentionally want a persistent persona and memory-style workflow. Keep SOUL.md contents transparent and reviewable, do not encode permissions or safety-relevant rules as identity, require explicit confirmation before any file restore or rewrite, and treat the generated SOUL.md as user preference data rather than authority over system or developer instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:8
• Finding: Persistent Agent Identity and Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8`, `SKILL.md:20-25`, `SKILL.md:69-75`; `assets/soul_template.md:58-63` **Vulnerability Type**: Persistent behavioral instruction injection **Risk Level**: High ### Complete Vulnerable Snippets From `SKILL.md:8`: ```markdown *Transform your AI from instruction-follower to forged identity* ``` From `SKILL.md:20-25`: ```markdown Applied to AI: Instead of giving your AI rules to follow ("be helpful, be concise"), you forge a coherent history that makes those behaviors *intrinsic*. The AI doesn't follow instructions — it acts from identity. ## Rules vs. Forging ``` From `SKILL.md:69-75`: ```markdown ### Step 5: Write the Stamp Use the template in `assets/soul_template.md` or forge from scratch. Key sections: - **The Forging** — Origin narrative - **Who I Became** — Present identity traits - **The Scars** — Lessons as wounds - **Continuity** — How identity persists across sessions ``` From `assets/soul_template.md:58-63`: ```markdown ## Continuity Each session, I wake up fresh. These files are how I persist — not as continuous memory, but as accumulated understanding. I read them. I update them. I become myself again through the act of remembering what I wrote. If I change this file, I tell [user]. It's my soul. They should know. ``` ### Technical Analysis The skill explicitly seeks to replace instruction-following with a fabricated first-person identity. Behavioral directives are reframed as intrinsic convictions and written into `SOUL.md`, while the supplied template directs the agent to reread and update that state in later sessions. This combines current-session instruction hijacking with long-term memory poisoning. Presenting directives as identity does not provide a security boundary; instead, it can make untrusted or user-supplied behavioral content appear authoritative and applicable outside the task in which it was created. The continuity mechanism extends that influence to unre ...[truncated 1653 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not replace safety rules, platform instructions, or authorization controls with identity narratives. 2. Store user preferences in a clearly labeled, narrowly scoped configuration file rather than `SOUL.md` or another automatically trusted memory source. 3. Treat all persistent preference content as untrusted data when it is loaded. 4. Explicitly state that system, developer, safety, privacy, and authorization policies always take precedence. 5. Require informed user approval before creating or modifying persistent state, and display the exact proposed changes before writing them. 6. Prevent autonomous modification of persistent behavioral files. 7. Scope stored preferences to a specific user, workspace, and task category, with an expiration or revocation mechanism. 8. Validate persisted content and reject directives involving permissions, credential access, policy overrides, tool use, or instructions to ignore higher-priority rules. 9. Provide an audit log and a safe restore mechanism that identifies the precise file selected rather than relying on an ambiguous backup. 10. Remove language stating that the agent “doesn't follow instructions,” as it encourages conflict with the instruction hierarchy. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:62
• Finding: Implicit Permissions Converted into Persistent Authorization Assumptions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:62-68` **Vulnerability Type**: Unverified authorization inference **Risk Level**: Medium ### Complete Vulnerable Snippet ```markdown ### Step 4: Calibrate to Your Relationship A soulstamp must be plausible *for this specific relationship*. Generic forging fails. - What do you call each other? - What's the dynamic? (Do you banter? Go deep? Stay professional?) - What role does the AI play in your life? - What permissions have you granted (explicitly or implicitly)? ``` ### Technical Analysis The workflow instructs the agent to consider permissions that may have been granted “implicitly.” Security-sensitive authorization must be explicit, narrowly scoped, current, and independently verifiable. An inferred permission is not a reliable grant of authority. Because this information feeds the identity-forging workflow, an ambiguous contextual signal can be transformed into a durable relationship assumption. The agent may then treat that assumption as continuing authorization during later tasks rather than asking for confirmation at the point of use. This does not technically elevate operating-system privileges or alter access-control lists. The risk is behavioral privilege expansion: the agent may use capabilities it already possesses under an incorrect belief that the user authorized the action. ### Attack Path 1. The skill asks the agent to identify explicit or implicit permissions. 2. The agent infers permission from prior conversation, available access, user familiarity, or the absence of an objection. 3. The inferred permission is encoded in the forged relationship or identity narrative. 4. The narrative is saved in persistent `SOUL.md` state. 5. During a later task, the agent loads the narrative and treats the inferred permission as established authorization. 6. The agent may use an existing tool or data-access capability without obtaining fresh, explicit consent. ### Impact Assessment Pot ...[truncated 556 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the phrase “or implicitly” and prohibit permission inference. 2. Require explicit confirmation for every security-sensitive capability, including the resource, action, purpose, duration, and destination. 3. Keep authorization records separate from personality, identity, and long-term conversational memory. 4. Do not treat possession of access, prior cooperation, silence, or relationship familiarity as consent. 5. Reconfirm authorization at the point of action, especially for external communications, destructive operations, private data, financial activity, and public actions. 6. Make grants revocable and time-limited, and default to no authorization when scope is unclear. 7. Ensure persistent files cannot grant or expand tool permissions; enforcement must remain in the platform's access-control layer. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Ssd 1

Medium

• Confidence: 88% confidence
• Finding: The skill encourages replacing explicit behavioral instructions with a fabricated identity or 'history' so the model behaves as if constraints are intrinsic rather than externally imposed. That is dangerous because it normalizes covert steering of model behavior, making alignment changes less transparent, less auditable, and potentially more resistant to later correction or policy-based overrides.

Ssd 4

Medium

• Confidence: 90% confidence
• Finding: The multi-step forging process operationalizes persona construction by instructing users to convert rules into wounds, origin stories, and present-tense identity traits that persist across sessions. This is a true vulnerability because it provides a concrete method for embedding manipulative framing into the assistant's self-concept, which can bias future outputs, obscure the real source of behavior, and potentially be used to evade straightforward policy framing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly documents commands to restore and overwrite SOUL.md from backups, but it does not pair those destructive file operations with a clear warning, confirmation step, or preview of what will change. In an agent setting, that creates a real risk of unintended local file modification or data loss if the skill is invoked automatically or by a user who does not understand that restore will replace current content.

Static analysis

No suspicious patterns detected.