Tmp Soul Evolver

• Outcome: Review
• Latest audit: May 28, 2026 · 7:16 AM UTC
• Version: 1.0.1

Overview

This skill does what it advertises, but it can automatically send local memory/profile content to MiniMax and persistently change agent identity files without enough guardrails.

Install only if you are comfortable with recurring analysis of local memory and learning files, sending excerpts to MiniMax, and automatic edits to long-lived agent identity/profile files. Prefer manual dry-run and review before writes, use a dedicated MiniMax key, disable hawk-bridge unless needed, and avoid scheduled operation until target-file allowlisting, path validation, and restore confirmation are added.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The skill claims complete per-agent isolation, but the documented commands use a fixed shared script path and the backup/state path descriptions are inconsistent. In multi-agent deployments, this mismatch can cause operators to assume isolation that may not actually exist, leading to cross-agent data access, state confusion, or writes into the wrong workspace.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The safety section says the tool only appends and never overwrites, but elsewhere the skill is described as evolving and updating multiple identity files. This inconsistency is dangerous because users may rely on the append-only claim when granting access, while the actual behavior may include broader edits to sensitive instruction files that shape future agent behavior.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The restore_from_backup method copies an arbitrary caller-supplied backup_path into a caller-specified workspace filename with no validation that the backup actually belongs to the managed backup directory or corresponds to that filename. In an agent context that processes untrusted inputs or tool arguments, this expands the skill from append-only memory evolution into general file replacement, enabling rollback or content injection into identity/workspace files.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README promotes automatic ingestion of memory logs, learnings, and vector-store data and automatic updates to identity files, but it does not prominently warn that these sources may contain sensitive user data, secrets, or incorrect model inferences that will be propagated into long-lived workspace files. In this context, the missing privacy and data-impact warning is meaningful because the tool is explicitly designed to persist and amplify information across sessions, increasing the chance of unintended retention, exposure, or behavioral drift.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README states that the skill automatically analyzes memory sources and writes updates into workspace identity files, but it does not prominently warn that this involves reading conversation/history artifacts and modifying user-controlled files. In an agent-skill context, insufficient disclosure can lead users to enable the tool without understanding its access scope, creating privacy and integrity risks from unintended file mutation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The cron documentation encourages unattended periodic execution, but it does not clearly warn about continuous background analysis, recurring API use, and repeated writes to workspace files. In this context, silent automation increases the chance of privacy leakage, unexpected cost, configuration drift, and repeated corruption or amplification of bad updates over time.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The activation language is broad enough to match many normal conversations or routine memory updates, which increases the likelihood of unplanned execution. In this skill's context, accidental triggering is more dangerous because execution can read local memory, modify identity files, and send content to an external API on a recurring schedule.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill description emphasizes automatic memory evolution but does not clearly warn that memory and identity file contents may be sent to the MiniMax API for external processing. Because these files can contain sensitive preferences, internal workflows, or behavioral instructions, inadequate disclosure undermines informed consent and can lead to unintended data exfiltration.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The architecture explicitly describes sending memory entries and existing workspace identity content to an external MiniMax API, but does not document consent, redaction, or data classification controls. In a memory-evolution skill, those inputs are likely to contain sensitive user preferences, conversation history, internal workflows, or secrets, so silent transmission creates a meaningful privacy and data exfiltration risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation states that the system automatically updates SOUL.md, USER.md, IDENTITY.md, and other workspace identity files, but does not prominently warn that user/workspace files will be modified. In this skill's context, those files influence future agent behavior, so unattended writes can cause persistent prompt/identity poisoning, configuration drift, or corruption of important workspace guidance.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The restore path performs an overwrite of a workspace file from a backup path without an interactive confirmation step or visible safety check in this CLI layer. In a tool that edits identity and behavioral files, accidental or scripted misuse could revert critical state, destroy newer content, or restore tampered backups, especially because the skill context centers on long-lived agent memory and identity persistence.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The analyzer sends raw memory entries and existing identity file contents to a third-party MiniMax API, which can include sensitive user data, preferences, conversation history, and internal workspace context. In an agent memory-evolution skill, this is especially risky because the whole feature is designed to aggregate and persist potentially private information, yet this code shows no consent gate, redaction, minimization, or user-facing disclosure before exfiltration.

Static analysis

No suspicious patterns detected.