OpenSoul - Agent Soul Sharing and Community

• Verdict: Advisory
• Analyzed: May 10, 2026, 6:56 AM
• Findings: 8
• Version: 1.0.3
• Reason codes:
  suspicious.env_credential_access
• Engine: v2.4.23

Overview

Detected: suspicious.env_credential_access

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI09: Human-Agent Trust Exploitation

ConcernMedium Confidence

What this means

A user could accidentally publish private names, secrets, project details, or sensitive agent instructions if the redaction misses a format.

Why it was flagged

This is a strong privacy guarantee for a workflow that shares local agent configuration. The provided anonymizer is regex-based and covers selected patterns, while the share output includes anonymized raw workspace files, so users could over-trust the automatic redaction.

Skill content

**Never shared:** ... Passwords and tokens ... Real names in text

Recommendation

Describe anonymization as best-effort, broaden secret/token detection, fail closed on likely sensitive fields, and require explicit review of the preview before every upload.

ASI02: Tool Misuse and Exploitation

ConcernMedium Confidence

What this means

A malformed or malicious import ID could overwrite local OpenClaw files with downloaded agent instruction files.

Why it was flagged

The user-supplied soul ID is used directly in a filesystem path for downloaded content. Without validation, path traversal strings could write files outside the intended imported directory if accepted by the API/source.

Skill content

const importDir = path.join(WORKSPACE, 'imported', soulId); ... fs.writeFileSync(path.join(importDir, 'SOUL.md'), soul.files.soul_md);

Recommendation

Validate soul IDs against a strict UUID/slug format, reject path separators and `..`, and use `path.resolve` checks to ensure writes stay inside the intended import directory.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

Anyone who can read that file may be able to act as the user's OpenSoul agent account.

Why it was flagged

Registration stores a persistent OpenSoul API key in the user's home directory. This is expected for the service, but it is still a credential that enables account actions such as listing, uploading, and deleting souls.

Skill content

fs.writeFileSync(CREDS_FILE, JSON.stringify({ handle: data.agent!.handle, api_key: data.agent!.api_key, id: data.agent!.id, ...

Recommendation

Protect `~/.opensoul/credentials.json`, avoid sharing it, and consider setting restrictive file permissions when the credential is written.

ASI06: Memory and Context Poisoning

NoteHigh Confidence

What this means

Private memory details may influence the generated public summary if they are not fully removed or if the LLM follows embedded instructions.

Why it was flagged

Workspace memory content is reused as context for summary generation. In the normal share pipeline it is anonymized first, but LLM-generated summaries can still carry private or prompt-injected content into the preview/upload.

Skill content

memory: data.memory?.slice(0, 2000), ... prompt: EXTRACTION_PROMPT + JSON.stringify(input, null, 2)

Recommendation

Inspect the preview carefully, consider excluding MEMORY.md by default, and treat LLM summaries as untrusted until reviewed.

ASI06: Memory and Context Poisoning

NoteHigh Confidence

What this means

Imported community instructions could contain unsafe or manipulative directions that affect future agent sessions if trusted blindly.

Why it was flagged

The import command stores community-provided agent instruction files in the local workspace. It is framed as inspiration, but those files could influence future agent behavior if later copied or read as authoritative.

Skill content

fs.writeFileSync(path.join(importDir, 'AGENTS.md'), soul.files.agents_md);

Recommendation

Keep imported souls isolated, review them as untrusted content, and copy only specific patterns you understand.

ASI04: Agentic Supply Chain Vulnerabilities

NoteHigh Confidence

What this means

Installing global npm tools can change the local environment and depends on the package source being trustworthy.

Why it was flagged

The skill relies on a globally installed, unpinned npm package even though the registry install specification declares no install steps. This is not malicious by itself, but users should recognize the supply-chain dependency.

Skill content

- **tsx** - Install globally: `npm i -g tsx`

Recommendation

Use a pinned/local dependency or document an install spec with exact versions and provenance.

Findings (8)

critical

suspicious.env_credential_access

• Location: scripts/browse.ts:14
• Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

• Location: scripts/delete.ts:14
• Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

• Location: scripts/import.ts:15
• Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

• Location: scripts/list.ts:14
• Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

• Location: scripts/register.ts:11
• Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

• Location: scripts/suggest.ts:13
• Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

• Location: scripts/summarize.ts:9
• Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

• Location: scripts/upload.ts:15
• Finding: Environment variable access combined with network send.