Security audit

soul-fireseed

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed personality-profiling tool, but it includes under-scoped background and historical conversation analysis plus unsafe helper scripts that deserve careful review before installation.

Install only if you intentionally want an agent to analyze conversations into a persistent personality profile. Prefer manual mode, avoid historical scans unless you select the exact data yourself, store outputs in a protected location, and do not run the shell scripts with untrusted filenames or arguments until they are fixed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:109
Finding: Historical Conversation Access and Covert Ongoing Personality Profiling
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/extract.sh:68
Finding: Arbitrary Python Code Execution Through Extraction Script Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/distill.sh:44
Finding: Arbitrary Python Code Execution Through Distillation Script Arguments
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:14
Finding: Mutable and Unverified Third-Party Dependency Installation
Content: View full analysis
=2.2.0", "scikit-learn>=1.0.0", "numpy>=1.21.0", "pandas>=1.3.0", "jinja2>=3.0.0" ] ``` ### Technical Analysis The documented installation process resolves packages dynamically from external package registries without exact versions, cryptographic hashes, a lockfile, or documented provenance verification. The `npx` command also invokes an external package-based installer without pinning the installer version. Lower-bound constraints such as `>=2.2.0` allow dependency contents to change after the Skill has been audited. A future compromised release, dependency takeover, malicious transitive dependency, or incompatible update could therefore alter installation-time or runtime behavior without any modification to this repository. No evidence was found that the currently named dependencies are malicious. The risk arises from mutable and unverified dependency resolution rather than from a confirmed malicious package. ### Attack Path 1. A user follows the documented `pip` or `npx` installation command. 2. The package manager resolves current package versions from an external registry. 3. A dependency, transitive dependency, installer package, or registry response has been compromised or changed since the audit. 4. The package manager downloads and installs the unr ...[truncated 783 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (58)

Ssd 3

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The background mode states that daily conversations can be scanned and traits extracted '在用户无感知的情况下完成提取'—without user awareness. Covert, ongoing psychological profiling from routine conversations is highly invasive and incompatible with informed consent, making this the most serious issue in the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README promotes scanning historical conversations and extracting personality traits, including sensitive behavioral and psychological inferences, without an explicit privacy warning or informed-consent flow. In this skill context, the feature is specifically designed to profile users from past communications, which makes omission of data-impact disclosure materially dangerous.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README presents daily/weekly automatic extraction, ongoing monitoring, change detection, and monthly evolution reports as normal usage without a clear warning that this constitutes recurring behavioral surveillance and profile generation. In a memory/personality skill, automation substantially increases privacy risk because collection expands over time and may capture sensitive changes in mental state, habits, relationships, and health-related cues.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This mismatch specifically mentions undeclared persistent storage of validation history to disk, which is security-relevant because it expands retention of derived behavioral data beyond the user-facing description. Hidden or insufficiently disclosed persistence of profiling metadata increases privacy risk and reduces informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: This mismatch specifically mentions undeclared persistent storage of validation history to disk, which is security-relevant because it expands retention of derived behavioral data beyond the user-facing description. Hidden or insufficiently disclosed persistence of profiling metadata increases privacy risk and reduces informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: This mismatch specifically mentions undeclared persistent storage of validation history to disk, which is security-relevant because it expands retention of derived behavioral data beyond the user-facing description. Hidden or insufficiently disclosed persistence of profiling metadata increases privacy risk and reduces informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This mismatch specifically mentions undeclared persistent storage of validation history to disk, which is security-relevant because it expands retention of derived behavioral data beyond the user-facing description. Hidden or insufficiently disclosed persistence of profiling metadata increases privacy risk and reduces informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This mismatch specifically mentions undeclared persistent storage of validation history to disk, which is security-relevant because it expands retention of derived behavioral data beyond the user-facing description. Hidden or insufficiently disclosed persistence of profiling metadata increases privacy risk and reduces informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description presents the skill as personality modeling and memory distillation without prominently warning that it analyzes conversations, infers sensitive traits, and stores persona profiles. Users cannot give informed consent if the privacy implications are omitted from the primary description.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow begins as casual conversation and incrementally builds toward personality extraction and eventual background profiling. This gradual escalation can cause users to disclose sensitive information under a low-risk framing before realizing it will be converted into a persistent psychological profile.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions explicitly direct the AI to scan prior conversations for work habits, life history, emotions, relationships, and self-reflection, then extract and persist those into a structured profile. This is sensitive personal-data processing and psychological profiling, which can reveal intimate attributes far beyond ordinary chat assistance.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The background automatic extraction section introduces ongoing profiling but does not provide a strong, explicit warning about continuous privacy impact. This is especially risky because one documented mode says extraction may occur 'without user awareness,' undermining informed consent and user control.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill documents persistent storage of fossils and persona profiles, including source quotes and timeline data, without a prominent retention warning. Retaining such detailed personal and inferred data increases harm in the event of unauthorized access, secondary use, or prolonged profiling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document promotes extraction of personality traits, autobiographical memory, emotional dynamics, social network data, and long-term evolution from user conversations, but provides no consent, minimization, retention, or privacy warning. Because this skill is specifically designed for sensitive inference and profiling, omission of safeguards materially increases the risk of covert surveillance, over-collection, and misuse of highly sensitive derived data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example workflow writes generated personality reports to local files such as profile.md without any warning that these files may contain sensitive inferred psychological and behavioral data. Storing such reports in plaintext or unmanaged local locations can expose users to unauthorized access, secondary use, and long-term persistence of intimate profile information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The best-practice section explicitly recommends automatic daily extraction from logs and periodic distillation, encouraging continuous analysis of sensitive personal content without discussing consent, scope limits, or review controls. In the context of a profiling skill, this makes the behavior more dangerous because it normalizes ongoing background monitoring and accumulation of sensitive inferences over time.
Content: No source excerpt is available for this finding.

Ae2

Medium

Category: analysis-evasion
Confidence: 90% confidence
Finding: Artifact content does not match its filename extension
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to install and run npx clawhub install soul-fireseed without pinning a specific package version or integrity mechanism. This creates a supply-chain risk: users may fetch a changed or compromised package at install time, and because the command is framed as a one-line installation path, many users are likely to execute it without review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This repeats an unpinned npx clawhub install soul-fireseed invocation in the primary installation instructions. Repetition in setup guidance increases the likelihood that users will execute an implicitly trusted remote package fetch, exposing them to package substitution or malicious updates.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section encourages broad collection of conversation content, memory analysis, automatic recurring extraction, and persistent persona generation. While these are core features, the guidance normalizes expansive profiling and retention without minimization boundaries, making overcollection a real security/privacy weakness in the context of a personality-modeling skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The community/ecosystem section again references npx clawhub install soul-fireseed without a pinned version, reinforcing unsafe installation behavior. Even in non-install sections, executable commands can be copied directly by users and carry the same supply-chain exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The examples show generating and writing evolution/personality outputs to files, which are likely to contain sensitive inferred personal data, but do not warn about storage security or secondary disclosure risks. Inferred traits and longitudinal reports can be more sensitive than raw conversation snippets because they condense intimate attributes into easy-to-share artifacts.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The later examples and best-practice guidance encourage preserving complete historical records, exporting profiles, backing up fossil data, and storing conversation-derived artifacts in databases. In this skill context, those records are directly tied to identity, behavior, and inferred traits, so broad retention and export materially increase breach impact and misuse potential.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill documentation describes reading prior conversations and writing extracted 'fossils' and persona profiles to local storage, but it does not declare any explicit tool scope or permissions. This creates a governance gap: a host may grant broader file capabilities than users expect, enabling silent access to conversation history and persistent profiling artifacts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation phrases include broad terms like '灵魂', '人格建模', and '数字孪生' that could appear in ordinary conversation and unintentionally trigger the skill. In this context, accidental invocation is dangerous because the skill performs profiling and may transition users toward sensitive memory analysis and persistent storage.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.