OpenSoul - An immutable, private soul for agent Self-reflection, self-improvement and on-chain economic activities.

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:06 AM UTC
• Version: 1.0.0

Overview

OpenSoul has a coherent blockchain memory purpose, but it asks users to handle wallet and PGP private keys while encouraging permanent logging of potentially sensitive agent activity without enough guardrails.

Review carefully before installing. Use only a new low-balance or testnet BSV wallet, never a wallet with meaningful funds. Do not log prompts, personal data, secrets, raw queries, document names, or confidential business details to the blockchain; prefer minimal redacted metadata, hashes, or strongly encrypted content. Avoid passphrase-less PGP keys, do not serialize private keys for handoff, protect or disable local backup JSON files, and audit the external OpenSoul repository before running its install script.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document claims the examples are 'production-ready with proper error handling,' but multiple examples call blockchain/network-dependent methods like flush() and get_history() without try/except, retry, timeout, or fallback handling. This can mislead users into deploying fragile code that fails unpredictably, loses logs, or exposes partial state during network errors.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module documentation presents this as a generic agent base template, but the implementation initializes blockchain-backed audit logging and reads a private key from the environment. That mismatch can mislead adopters into using the template without realizing it transmits session data externally and depends on sensitive key material, increasing the chance of unsafe deployment and unintended data exposure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The examples repeatedly encourage flushing agent logs to a blockchain and even viewing them in a public explorer, but they do not prominently warn that blockchain writes may be public, persistent, and effectively irreversible. Users may log prompts, tool outputs, session metadata, or other sensitive operational data without understanding the disclosure and retention risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples instruct users to export and use a private key via an environment variable without an accompanying security warning about the sensitivity of that credential. While environment variables are common, presenting key handling casually in example code can normalize unsafe operational practices and increase the chance of credential leakage through shell history, logs, or misconfigured environments.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The backup example writes pending logs to a local JSON file without warning that those logs may contain sensitive agent activity, prompts, metadata, or user data. This creates a secondary plaintext storage location that may be easier to access than the primary system and may persist longer than intended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The summary promotes immutable blockchain logging, complete history retrieval, and public audit trails, but does not clearly warn that data written to a blockchain may be permanent, broadly discoverable, and difficult or impossible to delete. In an agent skill, this can lead developers or agents to store sensitive prompts, user data, credentials, or behavioral traces under the false impression that optional encryption alone fully addresses the privacy risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup guide instructs users to create and broadcast a real blockchain transaction as a test, which irreversibly publishes data and spends wallet funds. Although the document later explains BSV usage, it does not give a clear upfront warning at the test step that this action is public, permanent, and may incur nontrivial consequences if users include sensitive data or use mainnet funds.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The batch GPG example includes %no-protection, which creates an unencrypted private key with no passphrase protection. This materially weakens key security because any filesystem access, backup leak, or accidental disclosure of the exported secret key would immediately compromise decryption capability and signing identity.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes storing agent actions, decisions, and results on a public, immutable blockchain, but the surrounding guidance does not prominently warn that this may expose sensitive prompts, outputs, operational metadata, or user-related data permanently. Because this is framed as a core capability for agents, implementers may adopt it by default and unintentionally publish confidential or regulated information that cannot be removed later.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill repeatedly encourages writing detailed agent activity to the BSV blockchain, but it does not present a prominent, explicit warning that blockchain data is public and effectively immutable, and that unencrypted logs can expose sensitive prompts, task details, operational metadata, or user data permanently. Although encryption is mentioned as optional/recommended, the surrounding examples normalize logging rich details by default, which materially increases the chance of accidental sensitive-data disclosure.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The agent handoff example shows exporting the BSV private key and PGP private key together as part of a transferable 'soul' without a strong warning that this grants full control over funds, identity, and access to historical encrypted logs. This pattern can lead users to normalize insecure key transfer or storage practices, enabling account takeover, unauthorized blockchain spending, identity impersonation, and compromise of confidential history.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The troubleshooting guide explicitly recommends `pip install ... --break-system-packages`, which disables Python distribution safeguards and can overwrite OS-managed packages. In an agent or production environment, this can destabilize the host, create dependency confusion, and make future patching or rollback harder.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide suggests appending `nameserver 8.8.8.8` to `/etc/resolv.conf` using `sudo`, which changes system DNS behavior without warning about persistence, breakage, or security/privacy implications. On many systems this file is managed by resolvers or network tools, so editing it directly can disrupt connectivity or redirect sensitive traffic handling.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code consumes a sensitive private key from BSV_PRIV_WIF without any prominent disclosure or guardrails in the template's documentation or initialization flow. In a reusable agent template, silently depending on a signing key increases the risk of accidental exposure, unsafe environment configuration, and unreviewed financial or identity-bearing operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The safe_flush method transmits accumulated logs to the blockchain, which is an external and potentially immutable destination, but this behavior is not clearly disclosed in the template's main documentation. Users may log task descriptions, research queries, dataset names, or other session metadata assuming local operation, causing unintended disclosure of sensitive operational context.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The backup routine persists pending logs to a local JSON file without explicit warning that session contents will be stored on disk. Even if impact is lower than blockchain transmission, local persistence can expose sensitive prompts, task metadata, or operational details to other users, backups, or endpoint compromise.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The agent archives research activity, including queries and session-derived metadata, to a blockchain and even prints a public transaction URL, but provides no explicit consent prompt, warning, or privacy safeguard. Because blockchain storage is durable and potentially public, sensitive research topics, operational interests, or user-entered queries could be exposed permanently.

Context Leakage

High

• Category: Data Exfiltration

Content

self.session_start_time = datetime.now()
        self.action_count = 0
        
        # Log session start
        await self._log_action(
            action_type="session_start",
            tokens_in=10,

• Confidence: 97% confidence
• Finding: Log session

Context Leakage

High

• Category: Data Exfiltration

Content

duration = datetime.now() - self.session_start_time
        
        # Log session summary
        await self._log_action(
            action_type="session_end",
            tokens_in=10,

• Confidence: 96% confidence
• Finding: Log session

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.