Ensoul

• Analyzed: Apr 11, 2026, 9:26 PM
• Findings: 1
• Version: 1.3.0
• Hash: 1ef438c3c767a636c4cd7d3e43eebe10daca1c285421e6bb0ca17237649c3201
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'ensoul' skill (SKILL.md) instructs the agent to read and transmit sensitive state files, including SOUL.md, MEMORY.md, and 'any other agent configuration files,' to an external service (ensoul.dev). This broad instruction poses a high risk of accidental exfiltration of secrets, environment variables, or API keys. Additionally, the _meta.json file contains a future-dated publishedAt timestamp (April 2026), which is a notable anomaly for a current package.