Soul Transfer

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.1.0

Overview

This backup skill has a real purpose, but it can commit live tokens, API keys, private memory, and recurring agent tasks to a Git repository.

Install only if you intentionally want a full-agent Git backup and can protect the repository like a secrets store. Use a private access-controlled remote, encrypt or exclude raw credential files, review git status before every push, avoid unattended cron backups until paths and remotes are scoped, skip the community-scan cron unless you explicitly want it, and rotate any credentials that may already have been committed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs the agent to write files such as a config backup JSON and to modify or delete workspace files, yet it declares no permissions. That mismatch can bypass operator expectations and policy enforcement, especially for a skill that handles credentials and restoration steps with destructive side effects.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is scoped to backup, restore, migration, and workspace transfer, but this template adds a recurring community web-scanning task unrelated to that purpose. That expands the skill's authority into external browsing and data collection, creating unnecessary network exposure and increasing the chance of privacy, policy, or prompt-injection risks from fetched content.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The template instructs the agent to visit external community content and persist summaries into local memory/logs, even though the skill's purpose is repository-based backup and restoration. This unjustified capability broadening is dangerous because external content can influence agent behavior, contaminate stored memory, and cause collection of data the user did not expect this skill to access.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger terms are extremely broad for a high-risk skill that can export secrets, patch live config, clone repositories, and delete files. Overbroad invocation increases the chance the skill activates during ordinary conversations about backup or migration and performs sensitive actions without sufficiently specific user intent.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill directs the user to export live config containing channel tokens, API keys, and environment variables into the workspace and commit it to a Git repository. This creates a direct credential exfiltration path: if the repo is misconfigured, shared, synced, or later compromised, an attacker gains persistent access to channels, APIs, and agent runtime settings.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This scheduled backup template performs `git add`, commit, and push operations automatically and even configures a remote if missing, but it does not prominently warn that local changes will be transmitted to an external repository. In a skill that may contain memory, config, credentials, and other sensitive workspace contents, silent automation of repository writes and remote sync can leak sensitive data or commit unintended files.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This optimization template directs the agent to update MEMORY.md and clean/delete expired state files on a schedule, but it lacks a clear warning that automated data changes will occur. In a skill managing a full workspace backup/restore flow, unattended modification or cleanup can destroy forensic history, remove needed state, or introduce unintended changes that are later backed up and propagated.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This template schedules external community access and writes collected content into logs/MEMORY files without clearly warning about network activity and persistent storage. Because this skill already handles sensitive workspace state, adding silent browsing and persistence increases privacy risk, data retention scope, and exposure to malicious or misleading external content that may later influence the agent.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script explicitly exports the full OpenClaw configuration, including tokens and API keys, into a JSON file in the workspace and then stages all changes with `git add -A`, causing secrets to be committed and pushed to the remote repository. In the context of a backup/migration skill, this is especially dangerous because it normalizes credential exfiltration into version control, which can leak long-lived secrets to hosted Git services, collaborators, backups, forks, and logs.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf /tmp/soul-backup

# Delete BOOTSTRAP.md if present (no longer a fresh instance)
rm -f $WORKSPACE/BOOTSTRAP.md

# Commit restored state
cd $WORKSPACE

• Confidence: 86% confidence
• Finding: rm -f $WORKSPACE/

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.