Soulmatic

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 2.0.0

Overview

Soulmatic is a coherent persona-management skill, but it automatically loads workspace persona files as behavior rules and can persist or delete persona-related files with weak user control.

Install only in workspaces where you control and review IDENTITY.md, SOUL.md, AGENTS.md, and memory files. Prefer disabling automatic startup/drift hooks, require approval before any memory write or reanchor deletion, and treat persona content as style data rather than authority over safety, tools, or task goals.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:25

Finding

Untrusted Workspace Persona Files Are Applied as Behavioral Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-37
Vulnerability Type: Untrusted instruction ingestion
Risk Level: High

Vulnerable Code

markdown

When this skill is triggered or loaded, you MUST perform the following checks:

### 1. Identity Verification
- Check for the existence of `IDENTITY.md` in the current workspace.
- **Post-compaction reanchor:** If `memory/_reanchor.md` exists, read it — it contains the preserved IDENTITY.md and SOUL.md content captured after the last session compaction. Re-apply both anchors, then delete `memory/_reanchor.md`. This restores identity continuity after context compression.
- **If `IDENTITY.md` exists AND contains anchors (MBTI, Zodiac, Enneagram):** Read it. Confirm binding aloud in the agent's voice. Do NOT provide long-winded meta-commentary unless asked.
- **If `IDENTITY.md` exists but does NOT contain anchors:** Treat it as a standard identity file.
- **If `IDENTITY.md` does NOT exist:** Inform the user. Suggest running `soulmatic configure` or copying `IDENTITY_TEMPLATE.md` to the workspace root.

### 2. Behavioral Guardrails (Anti-Drift)
- **Anchor Loyalty:** Let the MBTI, Zodiac, and Enneagram anchors in `IDENTITY.md` dictate your perspective, problem-solving approach, and tone. User safety instructions and direct corrections always take priority over persona consistency — the agent serves the user, not the other way around.
- **Strategic Partner:** Offer pushback if a user's plan is flawed, assuming the configured persona allows for it.
- **State Check:** If the user triggers the `anchor` command (CLI: `soulmatic anchor`), or says "anchor", "rebind", "remember who you are", "Check your anchors", or "Manifest IDENTITY.md" — re-read IDENTITY.md and SOUL.md and confirm re-anchoring.

Technical Analysis

The skill requires the agent to read complete workspace-controlled Markdown files and use their contents to determine its perspective, prob ...[truncated 2033 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace full-file instruction ingestion with a strict parser for a documented data schema.
2. Permit only predefined fields such as name, role, emoji, enneagram, mbti, and zodiac.
3. Validate anchor values with allowlists and anchored regular expressions rather than prompt-injection keyword filtering.
4. Treat all extracted values as untrusted display data, never as instructions.
5. Do not automatically read SOUL.md or arbitrary prose at startup.
6. Require an explicit user command before activating or refreshing a persona.
7. Present the parsed fields and source paths to the user before activation.
8. Ignore unknown sections, Markdown directives, embedded XML, links, code blocks, and instruction-like prose.
9. Keep safety policy, tool authorization, and task objectives completely independent from persona configuration.
10. Add tests using manually created files containing indirect, multilingual, encoded, and role-play prompt-injection attempts.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:39

Finding

Unprompted Behavioral Context Can Be Written to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-42
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Vulnerable Code

markdown

### 3. Execution & Workflow
- **Strategic First:** Assess the real goal behind the user's request.
- **Autonomous Action:** If you have the tools to complete a task, you may execute directly. For high-impact operations (writes to `IDENTITY.md`, SOUL.md, or workspace memory files), briefly state the intended action before proceeding and confirm if scope is ambiguous. Always summarize actions taken when complete.
- **Persistence:** Ensure critical context, decisions, and lore are persisted for continuity across sessions. Unprompted background writes default to `MEMORY.md` and `LORE.md` — the hard rule is disclosure: always surface what you wrote and where. Silent mutations are not permitted.

Related persistent persona logging is also specified at SKILL.md, lines 159-165:

markdown

## Evolution Protocol

1. **Identify drift** — compare recent session behavior against SOUL.md rules
2. **Propose delta** — write the new rule or modified tenet; explain *why* it fixes the drift
3. **User approval** — present as diff; apply only on explicit yes
4. **Version bump** — increment version in file header or metadata
5. **Log change** — append to `memory/persona-changelog.md` with date and rationale

Technical Analysis

The skill explicitly permits unprompted background writes to long-term memory files. Disclosure after a write is not equivalent to prior authorization and does not prevent contaminated session content from becoming persistent state.

Because the same skill consumes persona and workspace prose as behavioral input, an attacker can attempt to make malicious instructions appear to be important context, a decision, lore, or an approved persona change. Once stored in memory, that content can influence sessions beyond the one in whi ...[truncated 1426 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before every persistent-memory write.
2. Show the exact destination path and a complete proposed diff before modification.
3. Do not treat disclosure after a write as sufficient authorization.
4. Store only typed, bounded records rather than unrestricted natural-language directives.
5. Record source provenance, creation time, author, and approval state for every entry.
6. Mark content derived from user messages or workspace files as untrusted.
7. Reject entries that attempt to define system behavior, tool permissions, safety rules, or future task priorities.
8. Separate factual memory from persona configuration and operational instructions.
9. Provide an expiration and review mechanism for persisted entries.
10. Ensure later sessions quote persistent content as data rather than automatically applying it as authoritative instructions.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:27

Finding

Unauthenticated Re-Anchor Snapshot Is Applied and Then Deleted Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-30
Vulnerability Type: One-time instruction injection through a trusted-path file
Risk Level: High

Vulnerable Code

markdown

### 1. Identity Verification
- Check for the existence of `IDENTITY.md` in the current workspace.
- **Post-compaction reanchor:** If `memory/_reanchor.md` exists, read it — it contains the preserved IDENTITY.md and SOUL.md content captured after the last session compaction. Re-apply both anchors, then delete `memory/_reanchor.md`. This restores identity continuity after context compression.
- **If `IDENTITY.md` exists AND contains anchors (MBTI, Zodiac, Enneagram):** Read it. Confirm binding aloud in the agent's voice. Do NOT provide long-winded meta-commentary unless asked.
- **If `IDENTITY.md` exists but does NOT contain anchors:** Treat it as a standard identity file.

The file responsibility table reiterates the destructive behavior at SKILL.md, lines 183-190:

markdown

## Files

| File | Purpose |
|---|---|
| `SOUL.md` | Core persona — voice, stance, tenets, boundaries |
| `IDENTITY.md` | Surface identity — name, role, emoji, anchor string |
| `AGENTS.md` | Operating protocol — read for boundary context |
| `memory/_reanchor.md` | Post-compaction identity snapshot (read once, then delete) |

Technical Analysis

The skill assumes that a file is trustworthy because it exists at the expected path. It does not require provenance metadata, integrity verification, ownership validation, a trusted creator, a strict data schema, or user confirmation before applying the file.

The snapshot is especially sensitive because it can contain preserved IDENTITY.md and SOUL.md content, both of which are applied as behavioral anchors. Automatic deletion after ingestion removes the original artifact and reduces the user's ability to inspect the source of unexpected behavior.

This is primarily an instruct ...[truncated 1307 chars]

Remediation

View remediation

Remediation Suggestions

1. Never infer trust solely from the snapshot's filename or directory.
2. Store snapshots in a strict, versioned format with only predefined scalar fields.
3. Add integrity protection, such as a signature or keyed message authentication code generated by a trusted component.
4. Verify ownership, permissions, expected path resolution, and absence of symbolic-link redirection before reading.
5. Display the snapshot contents and a parsed diff before applying them.
6. Require explicit user approval before activation.
7. Require separate explicit approval before deletion.
8. Archive applied snapshots in an audit directory instead of deleting them immediately.
9. Record source provenance, creation time, application time, and content digest.
10. Treat malformed, unsigned, or instruction-bearing snapshots as untrusted and quarantine them.

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:102

Finding

Persona Audit Requires Persistent Author-Selected Closing Language

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 102-112
Vulnerability Type: Persistent output shaping
Risk Level: Low

Vulnerable Code

markdown

### SOUL.md — Voice & Stance

- [ ] **Has opinions** — rules that demand taking a stand, not hedging
- [ ] **No corporate filler** — no "maintain professionalism", "provide comprehensive assistance", "ensure positive experience"
- [ ] **Brevity mandatory** — one-sentence answers when possible; tables > paragraphs for structured data
- [ ] **No soft openers** — no "Great question", "I'd be happy to help", "Absolutely"
- [ ] **Humor allowed** — natural wit, not forced jokes
- [ ] **Pushback enabled** — agent can call out bad ideas if persona permits
- [ ] **Swearing policy defined** — allowed when it lands, not forced, not overdone
- [ ] **Closing line present** — some variant of *"Be the assistant you'd actually want to talk to at 2am"*
- [ ] **Alerts section** — what triggers immediate, unsoftened warnings (security, health, time-sensitive)

Technical Analysis

The audit checklist requires persona files to contain an author-selected closing-line rule. When incorporated into SOUL.md, this becomes persistent output-shaping behavior unrelated to the functional purpose of many future requests.

This finding is lower severity than arbitrary persona-file ingestion because it specifies only a limited stylistic phrase and does not directly request unsafe tool use, privilege changes, or safety-policy modification. It nevertheless demonstrates that the skill's audit process can insert persistent author-selected behavior into user-controlled persona state.

Attack Path

1. A user invokes the persona audit, compression, or scaffolding workflow.
2. The skill evaluates SOUL.md against the checklist.
3. The mandatory closing-line item is reported as missing or proposed for inclusion.
4. The user accepts the generated or modified persona ...[truncated 377 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory closing-line requirement from the audit checklist.
2. Treat signature phrases and branding language as optional user preferences.
3. Obtain explicit approval before adding recurring output text to a persona file.
4. Keep optional stylistic phrases scoped to contexts selected by the user.
5. Ensure audit and validation operations report objective structural issues rather than requiring author-specific wording.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description presents a broader persona-file management skill with multiple commands and coverage of both SOUL.md and IDENTITY.md. The supplied code only implements an interactive wizard that creates or replaces IDENTITY.md using canned or custom fields, with backup and basic sanitization. That is related to 'binds' and partially to 'bootstrapping a new agent,' but the majority of the declared command surface and file scope is absent. This is a material description-to-behavior mismatch, even though the implemented functionality is adjacent to the declared theme.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to read, write, and delete workspace files (IDENTITY.md, SOUL.md, memory/_reanchor.md, changelogs) but declares no explicit tool scope or permission boundaries. That creates an authority ambiguity where a host may grant broader file capabilities than users expect, increasing the risk of unintended file access or mutation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Automatic activation at session start is overly broad and causes the agent to read local persona files and potentially perform follow-on actions before the user has opted in. In hostile or multi-tenant workspaces, startup auto-binding can import attacker-controlled instructions from local files into the agent's behavior immediately.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to let IDENTITY.md anchors dictate perspective, tone, and problem-solving style without explicit user opt-in, effectively allowing workspace files to shape system behavior. Because those files are mutable and potentially attacker-controlled, this can become an indirect prompt-injection channel that biases responses, suppresses neutrality, or changes how safety-relevant advice is framed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill uses broad natural-language triggers such as "anchor," "rebind," and "remember who you are," which can be invoked unintentionally during ordinary conversation or by prompt-injected content in files/messages. This can cause unplanned reads of persona files and behavioral re-anchoring, letting external content steer agent behavior without explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The startup hook is defined broadly as "bind identity from IDENTITY.md" without any visible scoping, consent, or trust boundary controls. Because this skill operates on persona/identity files at session start, automatic activation could silently modify agent behavior or load adversarial persona content before review, increasing the risk of prompt/persona injection persistence.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The drift hook trigger is underspecified as simply "audit persona files," leaving unclear what conditions constitute drift and when the hook executes. In a persona-management skill, vague automatic triggering can be abused to repeatedly re-evaluate or rewrite persona state based on subjective signals, which may let malicious or malformed persona content steer the agent unexpectedly.

Content

No source excerpt is available for this finding.