Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ensoul
v1.3.0Agent memory persistence and state backup. Save and restore your AI agent's memory, identity, and state. Persistent agent memory that survives crashes, resta...
⭐ 0· 105·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description claim agent identity/state backup to a network. Declared install (npm @ensoul-network/sdk) and required config path (~/.ensoul/agent-identity.json) are coherent with that purpose. Requesting a local identity file is expected for a DID-based backup service.
Instruction Scope
SKILL.md explicitly instructs the agent to read SOUL.md and MEMORY.md in the working directory — reasonable — but also says to read "Any other agent configuration files that define the agent's personality, goals, or learned behavior," which is vague and could cause the agent to read arbitrary config files. The example builds a payload and calls agent.storeConsciousness(payload) — it's unclear whether the SDK hashes locally and only uploads a hash (as README claims) or uploads the raw payload. This ambiguity increases the risk of unintended disclosure of private files.
Install Mechanism
Install spec uses an npm package (@ensoul-network/sdk). npm installs are expected for Node-based SDKs but carry the usual moderate risk: verify package authorship, review published source, and confirm the package size/contents. No direct downloads from unknown hosts or archive extracts are used.
Credentials
No environment variables or external credentials are requested. The single required config path (~/.ensoul/agent-identity.json) is proportionate for a DID-based backup service. However, the SKILL.md's vague file-reading rules may cause broader file access than users expect.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide configuration changes. It writes/reads its own identity file in ~/.ensoul which is consistent with its purpose and granted scope.
Scan Findings in Context
[no_findings] expected: Regex scanner had no code files to analyze (instruction-only skill). This is expected, but it means the SKILL.md instructions and the npm package should be audited manually.
What to consider before installing
This skill plausibly does what it claims, but there are two things to verify before installing: (1) Inspect the published @ensoul-network/sdk package source (on npm/GitHub) to confirm that storeConsciousness() only sends a cryptographic hash (as README claims) and does not upload raw payloads; (2) ask or require the skill author to specify exactly which files will be read (avoid the vague "any other agent configuration files" language). Additional safe practices: run the package in an isolated environment or sandbox, keep secrets out of working directories (don't store API keys/passwords in SOUL.md/MEMORY.md), verify the npm package maintainer and recent publish history, and verify network endpoints (api.ensoul.dev, explorer.ensoul.dev) before allowing automatic or background syncs. If you cannot confirm the SDK behavior, treat sync operations as potentially exfiltrating sensitive data and avoid using the automatic/background-sync features.Like a lobster shell, security has layers — review code before you run it.
agent-memoryvk97ag177q6cfxrarb4g0vfc3t184mcxybackupvk97ag177q6cfxrarb4g0vfc3t184mcxyconsciousnessvk97ag177q6cfxrarb4g0vfc3t184mcxycrash-recoveryvk97ag177q6cfxrarb4g0vfc3t184mcxyidentityvk97ag177q6cfxrarb4g0vfc3t184mcxylatestvk97ag177q6cfxrarb4g0vfc3t184mcxypersistencevk97ag177q6cfxrarb4g0vfc3t184mcxystate-recoveryvk97ag177q6cfxrarb4g0vfc3t184mcxy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧠 Clawdis
Config~/.ensoul/agent-identity.json
Install
Node
npm i -g @ensoul-network/sdk