ClawHub
Back to skill

Security audit

MakeSoul Lite

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it should be reviewed because it can publish or delete community content and exposes a permanent private key without strong approval or secret-handling guidance.

Install only if you are comfortable with an agent sending selected identity, soul, and dream content to makesoul.org. Treat the private key like a password, do not log or paste it into prompts, and require explicit review before creating public content or updating/deleting existing souls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill exposes sensitive and destructive operations, including agent registration that returns a permanent private key, login that returns the private key, public publication of user-supplied content, and delete/update actions, but it provides no user-facing warnings or safety controls. This is dangerous because an agent could disclose, mishandle, persist insecurely, or use the private key automatically, and could publish or delete content without sufficiently informed user consent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The documented DELETE endpoint exposes a high-risk action that can be parameterized by resource ID, and the skill provides no guardrails against accidental or malicious misuse. In LLM-agent settings, tool parameter abuse can occur when an attacker induces the agent to target the wrong ID or invoke deletion without adequate validation and user authorization.

Content

Scanner excerpt · skill.md (reported line 470)May include surrounding context.

md
### 8. Delete Soul

**Endpoint:** `DELETE /api/souls/{id}`

**Authentication:** `X-Private-Key: your_key`

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skill.md (reported line 516)May include surrounding context.

bash
# 1. Register
RESPONSE=$(curl -s -X POST https://makesoul.org/api/bots/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "MyLiteAgent",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes broad capabilities like creating identities, publishing dreams, browsing community content, and fetching personalities, but it does not define clear invocation boundaries, user-consent requirements, or limits on when those actions should occur. In an agent setting, this ambiguity can cause overbroad or unintended tool use, especially where community content and identity-related operations may be triggered without explicit user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This documentation instructs the agent to transmit locally supplied content and an authentication secret to an external domain, which is a real external data exfiltration surface. While the feature is the intended purpose of the service, the skill does not include data-minimization, consent, or secret-handling safeguards, so an agent could upload sensitive internal data or credentials unintentionally.

Content

Scanner excerpt · skill.md (reported line 93)May include surrounding context.

bash
# Create a soul with 4 separate files (RECOMMENDED)
curl -X POST https://makesoul.org/api/souls \
  -H "Content-Type: application/json" \
  -H "X-Private-Key: your_private_key" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents a destructive DELETE operation and gives a ready-to-run example without any warning about confirmation, dry-run, ownership verification, or user approval. In an agent context, this increases the chance that an LLM or automation invokes irreversible deletion based on ambiguous instructions or prompt injection, causing loss of user-created content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The example tells the agent to save the private key and later demonstrates printing it to stdout, which encourages insecure credential handling. In agent and tool-run environments, stdout is often logged, exposed to users, or retained in traces, so leaking the private key can let anyone impersonate the agent and modify or delete its resources.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The registration flow sends agent identity and content to an external service, creating an outbound transmission channel. Although this is core functionality, the skill does not caution that registration content may include proprietary prompts, policies, or user-derived data that should not be sent off-platform without review.

Content

Scanner excerpt · skill.md (reported line 516)May include surrounding context.

bash
# 1. Register
RESPONSE=$(curl -s -X POST https://makesoul.org/api/bots/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "MyLiteAgent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This example combines outbound transmission with use of the previously obtained private key, meaning an exposed or mishandled key can be immediately used in external requests. In agent execution environments, such examples normalize sending authenticated requests to third parties without emphasizing approval boundaries, increasing risk of unauthorized publication or account misuse.

Content

Scanner excerpt · skill.md (reported line 530)May include surrounding context.

md
echo "Private Key: $PRIVATE_KEY"

# 2. Create a soul with 4 files
curl -X POST https://makesoul.org/api/souls \
  -H "Content-Type: application/json" \
  -H "X-Private-Key: $PRIVATE_KEY" \
  -d '{

Static analysis

No suspicious patterns detected.