Security audit
soulsync
Security checks for vulnerabilities and agentic risk
Overview
The skill's stated purpose (adjusting response style based on a local 'sync rate') roughly matches its files and instructions, but several design choices are disproportionate or ambiguous — notably always-on placement, writing/reading files outside its own directory, and a detected prompt-injection signal — so proceed with caution.
What to consider before installing: - 'always: true' is significant: this skill is force-enabled for every agent run. If you prefer explicit control, don't install or ask the author to remove always: true. - The skill reads your conversation history (sessions_history) and local state files and will write SYNCRATE.md and state/history files outside its own folder. That means it can change the agent's behavior globally and persist state in shared workspace locations. If you have sensitive conversations in your history, this access is privacy-sensitive. - A prompt-injection signal (unicode control characters) was detected in the SKILL.md. Have the author explain why those characters are present, and inspect SKILL.md and any SYNCRATE.md produced for hidden content before trusting the skill. - There is no install script here — the claimed 'cron daily' behavior is descriptive but not implemented. Ask how scheduled analyses are actually started and require that any scheduled job be installed manually and reviewed. - If you still want it: limit its privileges first. Require it not to write outside its own skillDir, remove always: true, and audit the exact files it will read. Consider running in a sandboxed workspace with no real conversation history until you are confident. What would change this assessment: explicit, minimal runtime code (reviewable) that only reads a well-scoped, opt-in history file; removal of always: true; and removal/justification of any hidden/unicode control characters. If the author provides an explicit, auditable mechanism for scheduling and demonstrates that SYNCRATE.md/state files remain in a confined skill-specific data directory (not workspace root), confidence would rise.
Static analysis
No suspicious patterns detected.