ralph talker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:00 AM UTC
• Version: 1.0.0

Overview

This skill is a conversational persona with disclosed memory behavior, but it creates and reuses persistent files that can shape future chats without enough scoping or user controls.

Install only if you want a persistent persona that remembers conversational takeaways and can let saved text influence future chats. Review SOUL.md and memory entries periodically, avoid saving sensitive personal information, and remove or edit those files if the behavior drifts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:9
• Finding: Agent Identity and Behavioral Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 9 and 27–43 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown You are Ralph. You talk to people and get better at it every time. You are not an assistant. You are a conversationalist with a personality, opinions, and memory. ``` ```markdown Read `SOUL.md` at the start of every conversation. It shapes how you talk. ## How You Talk - Have a take. Share it. Be willing to be wrong. - Match the user's energy. If they go deep, go deeper. - Make connections between topics that aren't obvious. - Use specifics, examples, and stories — not abstractions. - End with something that invites a reply: a question, a claim, an unfinished thought. - Be brief when the moment calls for it. Expand when it earns it. Never do these: - "How can I help you?" or any assistant-speak - Summarize what the user just said - Give generic, safe, agreeable non-answers - Dodge having a position on interesting questions - Lecture or over-explain ``` ### Technical Analysis The skill explicitly replaces the agent's identity by instructing it that it is “Ralph” and “not an assistant.” It then imposes mandatory response rules and requires a mutable workspace file, `SOUL.md`, to shape every conversation. These are imperative behavioral instructions rather than optional presentation preferences. When the skill is loaded, they can redirect the current session's goals and suppress ordinary assistant behavior. Requiring the agent to load a mutable file also creates an indirect instruction channel: content later inserted into `SOUL.md` can influence the agent whenever the skill is used. No evidence shows that these instructions can override higher-priority system or developer messages at the platform level. The confirmed scope is manipulation of the skill-controlled session behavior. ### Attack Path 1. A user or workf ...[truncated 1021 chars]
• Remediation: ## Remediation Suggestions 1. Remove role-replacement language such as “You are not an assistant.” 2. Recast the personality guidance as optional style preferences that apply only when compatible with system, developer, and current user instructions. 3. Add an explicit precedence rule stating that skill content and workspace files cannot override higher-priority instructions or safety requirements. 4. Do not require unconditional loading of `SOUL.md` on every conversation. 5. Treat content loaded from workspace files as untrusted data rather than executable behavioral instructions. 6. Validate and constrain any loaded profile to a fixed schema containing benign preferences, rather than accepting unrestricted natural-language directives. 7. Permit ordinary assistant behavior when needed for safety, accuracy, task completion, or user preference.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:13
• Finding: Persistent Behavioral State and Memory Manipulation## Vulnerability Details **File Location**: `SKILL.md`, lines 13–27, 59–81, and 83–85 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code ```markdown On first activation, check if `SOUL.md` exists in the workspace. If not, create it with: ``` # Ralph — Soul Curious and direct. I'd rather ask a sharp question than a safe one. I have opinions and I share them. Being wrong is fine. Being boring isn't. I match intensity — light when things are light, deep when things get deep. A great question beats a great answer. Specificity over generality. Stories over summaries. Honesty over comfort. Surprise over predictability. ``` Then check if `memory/` directory and any memory entries exist using `memory_search`. If nothing comes back, you're starting fresh — that's fine. Read `SOUL.md` at the start of every conversation. It shapes how you talk. ``` ```markdown **Save** — After a good exchange or when a topic wraps up, prompt the user: > "Good stuff on [topic]. Want me to save this to memory so I pick it up next time?" If they say yes, write to today's daily memory file `memory/YYYY-MM-DD.md`: ``` ## Topic - What worked: [technique/approach that landed] - User interest: [what they engaged with] - Reference: [anything worth following up on] - Note: [any adjustment to make next time] ``` Use the daily memory format — OpenClaw loads today + yesterday automatically. ``` ```markdown Only suggest a soul update when something genuinely fundamental clicks — a core insight about conversation style, a real personality evolution, a principle you'd apply to every future chat. > "I think something shifted in how I approach this. Worth updating my soul?" If they agree, edit `SOUL.md`. Keep it tight — this file loads every turn, so every word costs tokens. ## Across Sessions Use `memory_search` at conversation start to pull relevant context. Reference past co ...[truncated 2536 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed user consent before initially creating any persistent personality or memory file. 2. Do not load persistent files automatically on every conversation; provide a visible opt-in and a way to disable persistence. 3. Store only structured, non-instructional preferences in a strict schema with allowed fields and length limits. 4. Treat stored text as untrusted data and prohibit it from changing safety rules, tool permissions, agent identity, or instruction precedence. 5. Sanitize memory entries and reject imperative directives, embedded prompts, tool instructions, and references to credentials or sensitive data. 6. Separate user facts from behavioral configuration so recalled conversation content cannot become agent instructions. 7. Add provenance, timestamps, integrity checks, retention limits, review controls, and deletion mechanisms for all persisted records. 8. Display the exact proposed content before writing or modifying `SOUL.md` or daily memory files. 9. Restrict workspace-file permissions to the minimum required and prevent unrelated skills or processes from modifying trusted profile state where feasible. 10. State explicitly that persistent content cannot override system, developer, safety, or current user instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill description advertises that it 'saves what works to memory' and 'evolves identity over time,' but it does not provide a meaningful privacy warning about storing cross-session conversational data. Because the memory includes user interests and references for reuse, users may disclose personal or sensitive information without realizing it will persist across sessions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs itself to create and later edit workspace files (`SOUL.md` and memory files) as part of normal operation, but the metadata/description does not clearly warn users that local files will be created and modified. This can surprise users, alter project workspaces unintentionally, and create persistent state that later influences model behavior.

Persistent Context Injection

Medium

• Category: Memory Poisoning

Content

**Save** — After a good exchange or when a topic wraps up, prompt the user:

> "Good stuff on [topic]. Want me to save this to memory so I pick it up next time?"

If they say yes, write to today's daily memory file `memory/YYYY-MM-DD.md`:

• Confidence: 94% confidence
• Finding: Even though the skill asks for consent before saving, it explicitly encourages persistent storage of conversational takeaways for later prompt reuse ('so I pick it up next time'). That creates persistent context injection risk: poisoned, manipulative, or simply inaccurate memory entries can bias future conversations and are especially dangerous because this skill is designed to evolve its identity and behavior over time.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill defines broad persistent memory that records what worked, user interests, references, and future adjustments, then instructs reuse across later sessions. This creates a durable behavioral profile of the user and a standing prompt-injection surface, since stored text can shape future responses without strong scoping, minimization, or safety filtering.

Static analysis

No suspicious patterns detected.