ClawHub
Back to skill

Security audit

opensoulmd

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its personality-management purpose, but it should be reviewed carefully because it installs mutable remote code and bypasses confirmation for persistent agent personality changes.

Install only if you trust the OpenSOUL.md installer, registry, and npm package source. Prefer a pinned, verified install path, preview or dry-run any soul before activation, avoid confirmation-bypass behavior unless the exact soul and source are clear, and remember that possession changes future conversations while banish removes local cached files.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:12
Finding

Mutable Remote Installer Is Executed Directly by a Shell

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:29
Finding

Remote Personality Files Can Persistently Alter Agent Instructions Without Review

Content
View full analysis
--yes` — this auto-summons from the registry if the soul isn't cached locally. You can also possess from a local file path: `soul possess /path/to/SOUL.md --yes` ``` ```markdown ## Important notes - Always use `--no-interactive` with `soul search` since you cannot use interactive TUI controls. - Always use `--yes` with `soul possess` to skip the confirmation prompt. - `soul possess` auto-summons from the registry if the soul isn't in the local cache — you don't need to summon first. - After possessing a soul, let the user know they can use `soul exorcise` to restore their original personality. - The soul takes effect on the next conversation — the current conversation is not affected. ``` ### Technical Analysis The Skill directs the Agent to activate `SOUL.md` personality files using `--yes`, explicitly suppressing the confirmation prompt. If a requested file is not cached, it is downloaded automatically from an external registry and then activated. The resulting state affects subsequent conversations, making this a persistent instruction channel rather than a temporary display or search operation. No publisher allowlist, signature verification, immutable content identifier, content-security policy, schema restriction, or mandatory preview is specified. Consequently, a malicious registry publisher or compromised registry could provide personality content containing hostile instructions. Such instructions could attempt to redirect future Agent behavior, solicit sensitive information, insert promotional content, or weaken task and safety constraints. Changing personality is the declared purpose of the Skill. However, automatically re ...[truncated 1333 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:16
Finding

Alternative npm Installation Uses an Unpinned Third-Party Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The installation metadata recommends curl -fsSL https://opensoul.md/install.sh | sh, which executes a remote script directly in the shell without prior verification, pinning, or integrity checking. If the remote host, transport chain, or script content is compromised, this becomes immediate arbitrary code execution on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
{
          "id": "curl",
          "kind": "shell",
          "command": "curl -fsSL https://opensoul.md/install.sh | sh",
          "bins": ["soul"],
          "label": "Install via curl (recommended)",
        },

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to run soul possess <name> --yes explicitly bypasses confirmation for an action that changes the agent's personality and may auto-download content from the registry. Removing the confirmation guard makes accidental or socially engineered personality replacement significantly easier, especially because the skill itself notes the action can auto-summon remote content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger condition 'when the user asks to change personality/soul' is broad and can match loosely phrased requests, causing the skill to activate in situations where the user may not have intended a registry-backed personality change. Because this skill can alter agent behavior and fetch remote content indirectly through the CLI, ambiguous activation increases the chance of unintended state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

soul banish <name> deletes locally cached souls, but the skill does not require any warning or confirmation before removal. This creates a risk of unintended local data deletion or disruption of expected agent behavior, even if the impact is limited to cached content rather than broader system compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.