T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib/importers/local_system.py:23- Finding
Excessive Local-System Reconnaissance Outside the Declared Workspace Boundary
- Content
View full analysis
- Remediation
View remediation
Security audit
Soul Sync
Security checks for vulnerabilities and agentic risk
Overview
Soulsync is a real personalization skill, but it accesses and retains sensitive account and local-system profile data more broadly than its own privacy promises describe.
Review before installing. Use this only if you are comfortable letting the skill derive a personal profile from sensitive sources, and avoid optional imports such as Local System, YouTube, contacts, Gmail, or social exports unless you explicitly want that data processed. Do not keep OAuth credentials in a synced or committed workspace, and delete /tmp/soulsync plus .soulsync-state.json if you test it and want the retained profile artifacts removed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
lib/importers/contacts.py:147- Finding
Sensitive Profile Data Stored in Predictable Temporary Files and Exposed Through Standard Output
- Content
View full analysis
has_phone else 'Phone-centric'} communicator based on contact data", }, ``` ```python output_path = os.path.join(IMPORT_DIR, "contacts.json") with open(output_path, "w") as f: json.dump(result, f, indent=2) print(json.dumps(result, indent=2)) ``` The same fixed directory is used throughout the importer suite: ```python IMPORT_DIR = "/tmp/soulsync" ``` The Gmail importer similarly retains email identifiers and service information: ```python "insights": { "communication_style": comm_style, "key_contacts": all_contacts, "interests": top_interests, "work_patterns": patterns, "tone": tone, "services_used": sorted(services_used)[:15], "top_newsletter_senders": [s for s, _ in newsletter_senders.most_common(10)], }, ``` ### Technical Analysis Importer results are stored as plaintext JSON under a fixed, predictable `/tmp/soulsync` directory. Files are opened without explicitly enforcing restrictive permissions, without checking for symbolic links, and without atomic creation. Each importer also prints its complete result to stdout. The stored data is not merely anonymous aggrega ...[truncated 2045 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib/followup.py:73- Finding
Ongoing Personalization Opt-Out Does Not Disable Passive Learning
- Content
View full analysis
list[dict]: """Scan a normal message for personality/preference signals. Returns list of facts learned. Does NOT update files — just queues for confirmation.""" if not state.passive_learning: return [] ``` ```python def set_ongoing(enabled: bool, state: FollowUpState = None): """User opts in or out of ongoing personalization.""" if state is None: state = FollowUpState.load() state.ongoing_enabled = enabled state.save() return {"ongoing_enabled": enabled} ``` ```python elif cmd == "passive" and len(sys.argv) >= 3: message = " ".join(sys.argv[2:]) state = FollowUpState.load() learned = passive_scan(message, state) print(json.dumps({"learned": learned, "pending_confirmations": len(state.pending_confirmations)}, indent=2)) elif cmd == "opt-out": print(json.dumps(set_ongoing(False))) ``` ### Technical Analysis The opt-out operation sets `ongoing_enabled` to false but does not set `passive_learning` to false. Passive scanning checks only `passive_learning`, which defaults to true. Therefore, invoking the `passive` command after opt-out still extracts and persists facts. The saved facts can include locations, employers, partner or child names, possessions, preferences, and excerpts from the source message. This contradicts the documented claim that passive learning is active only when the user opts in a ...[truncated 1346 chars]- Remediation
View remediation
other
Warning
- Location
lib/importers/twitter.py:19- Finding
Twitter User Identifiers Disclosed to Community-Operated Nitter Instances
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (145)
Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python ) try: with urllib.request.urlopen(req) as resp: result = json.loads(resp.read()) return result.get("access_token") except Exception:
Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python ) try: with urllib.request.urlopen(req) as resp: result = json.loads(resp.read()) return result.get("access_token") except Exception:
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises imports from Gmail, Calendar, Contacts, Local System, social platforms, and other rich sources, but does not present a strong, explicit warning that these sources may expose highly sensitive personal, professional, and relationship data. In this context, insufficient disclosure is dangerous because users may consent without understanding the breadth of collection and inference, especially where local scans include shell history, apps, repositories, and bookmarks.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 78% confidence
- Finding
The README tells users to save
credentials.jsonto the workspace and notes reuse of existing OAuth material and git credential stores. Workspaces are frequently synced, committed, or scanned by tools, so placing OAuth client material and potentially adjacent tokens in that location increases the chance of credential exposure or unintended reuse by other components. Given this skill's focus on importing personal data, credential compromise could grant broad access to email, calendar, contacts, or private repositories.- Content
md ### Gmail & Calendar Reuses existing OpenClaw Gmail OAuth if available. Otherwise: 1. Create OAuth credentials at [Google Cloud Console](https://console.cloud.google.com/apis/credentials) 2. Save `credentials.json` to your workspace 3. First run will prompt for browser auth ### GitHub
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
YouTube/Takeout analysis plus local Downloads/Desktop scanning is materially broader than the user-facing description suggests. Watch history and subscriptions can expose beliefs, health interests, and other sensitive traits, especially when discovered through automatic filesystem searches.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Broad trigger phrases for a data-collecting personalization skill risk accidental activation during ordinary conversation. Unintended activation is especially dangerous here because the skill can begin profiling, asking invasive questions, or initiating imports based on ambiguous user language.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest limits file access to the workspace, but the skill writes data to /tmp/soulsync outside that boundary. Violating a stated storage boundary undermines user trust and can expose data to other local processes or weaker temporary-directory protections.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Using vague examples and 'etc.' for activation rules leaves too much room for over-triggering by the agent. For a sensitive skill, ambiguous triggers materially increase the chance of unsolicited collection and context hijacking.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Auto-triggering on the user's first message if profile files are empty can hijack unrelated conversations and start collecting profile data without a request about personalization. Because this skill handles sensitive personal information, unsolicited startup significantly raises privacy and autonomy concerns.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Local system inspection is not necessary to satisfy the stated purpose of agent personalization and introduces disproportionate data access. Reading shell history, installed apps, bookmarks, repos, or SSH config for 'personalization' violates data minimization and creates outsized exposure if mishandled.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest claims imported raw data is never persisted, yet the instructions explicitly write importer JSON artifacts to /tmp/soulsync. Contradicting a core privacy assurance is dangerous because users may consent based on false non-persistence guarantees while sensitive derived or raw data is actually stored on disk.
- Content
Static analysis
No suspicious patterns detected.