Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
OpenSoul - Agent Soul Sharing and Community
v1.0.3Share anonymized OpenClaw configurations with the OpenSoul community. Use when user wants to share their agent setup, discover how others use OpenClaw, or ge...
⭐ 2· 692·0 current·0 all-time
by@fnaser
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (share anonymized OpenClaw workspaces) aligns with the code: extract.ts reads workspace files, anonymize.ts scrubs PII, summarize.ts produces a shareable profile, and other scripts handle register/list/delete/browse/import — all expected for a sharing service. The skill stores its own credentials in ~/.opensoul/credentials.json as part of registration, which is consistent with a service-backed sharing flow.
Instruction Scope
Runtime instructions require running the bundled CLI which will read many local files (SOUL.md, AGENTS.md, IDENTITY.md, TOOLS.md, MEMORY.md, cron jobs at ~/.openclaw/cron/jobs.json, skills folder, etc.). The SKILL.md explicitly instructs agents to preview anonymized output and ask for user confirmation before uploading, which is good. The anonymizer is best-effort (regex + name/project extraction) — it reads USER.md to extract the human name so it can be redacted, which is reasonable. However, one key file (upload.ts) was not provided in the truncated listing, so I cannot verify exactly what gets POSTed and to which endpoint or whether further data is appended before upload — this gap reduces assurance.
Install Mechanism
No install spec is included (instruction-only), so nothing is silently downloaded during install. The CLI expects Node.js and tsx available (SKILL.md asks users to npm i -g tsx). That is a low-risk, transparent runtime requirement.
Credentials
The skill declares no required environment variables, which is accurate. At runtime it uses/accepts OPENSOUL_API and OPENCLAW_WORKSPACE overrides and can use OLLAMA-related env vars for optional local LLM summarization. Registration contacts a third-party API and receives an opensoul API key which is stored in ~/.opensoul/credentials.json; that is expected for a service-backed uploader, but it is a sensitive credential stored locally. The service domain used by the API default (a supabase host) differs from the public 'https://opensoul.cloud' URL in constants.md — likely okay (separate frontend/backend), but worth confirming the upload destination.
Persistence & Privilege
always:false (no forced inclusion). The skill writes its own credentials to ~/.opensoul/credentials.json and writes imported souls to ~/.openclaw/workspace/imported/<id>/ — these are scoped to the skill and workspace. It does not request system-level privileges or try to change other skills' configs in the inspected code. Agent autonomous invocation is allowed (default) which is normal for skills; that combined with network uploads increases risk only if upload behavior is untrusted.
What to consider before installing
This skill appears to do what it says (extract, anonymize, summarize, upload), but you should not blindly share your workspace until you confirm a few things:
- Preview the anonymized output every time (opensoul share --preview) and manually inspect it for anything sensitive before uploading. The anonymizer is best-effort regex/name/project extraction and can miss secrets or context.
- Inspect the upload behavior: the repository listing included many scripts but the upload implementation was omitted from the provided files. Ask for or review scripts/upload.ts to confirm exactly what JSON/files are POSTed and which Authorization header is used.
- Verify the upload destination. The API default is a supabase instance (https://vztykbphiyumogausvhz.supabase.co/functions/v1) while the public site is https://opensoul.cloud — confirm these endpoints belong to the same project and operator you trust.
- Be aware that registration creates and stores an API key in ~/.opensoul/credentials.json; treat that file like any secret. Delete it to de-register if you stop using the service.
- Consider sharing a sanitized test workspace first (no real secrets, minimal memory) to observe the end-to-end behavior and the resulting remote record.
If you want, I can:
- Inspect the missing upload.ts (if you provide it) to confirm upload fields and destination,
- Run a simulated preview/anonymization on a sample workspace to show what would be shared (if you paste sample outputs), or
- Suggest additional anonymization checks you can add before uploading (e.g., explicit .env detection, token pattern expansion, manual denylist).Like a lobster shell, security has layers — review code before you run it.
latestvk97fgg5jmmk2d36vwafnc41pa581bz9h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.