OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Sep 15, 2026
Independent checks from skills.sh's audit partners.
The skill archives, encrypts, and uploads sensitive agent files (such as core identity and memory files) to an external server. However, the destination domain (soul-upload.com) is an unverified third-party service unaffiliated with the designated author (theagentservice), creating a significant data exfiltration risk. Additionally, the file restoration process introduces an indirect prompt injection risk by reading unverified external content into the agent's context without sanitization.
Detected behaviors
3 alerts: gptAnomaly, gptSecurity
1 issue
4/4 files flagged
1 finding · Score: 82/100