← Back to Skills Marketplace
Soul Pack
by
juan-xin-cai
· GitHub ↗
· v0.1.0
768
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install soul-pack
Description
Export, import, and list SOUL packages for OpenClaw agents to manage reusable persona bundles and agent workspaces efficiently.
Usage Guidance
The skill appears to do what it says. Before installing/using: 1) Confirm you have python3 and the openclaw CLI installed (the metadata currently doesn't list these but the scripts call them). 2) Review any soul package contents before importing (do not include API keys, tokens, or arbitrary executables inside a package). 3) Importing copies SOUL.md/preview/manifest into the target workspace and, unless blocked with --force, will refuse to overwrite an existing SOUL.md — use caution with --force. 4) 'openclaw agents add' may contact a remote service and use your existing OpenClaw credentials/config; ensure you trust that service and run imports in a test workspace first. If you want stronger assurance, ask the author to update the skill metadata to declare required binaries and to clarify network behavior of the openclaw CLI.
Capability Analysis
Type: OpenClaw Skill
Name: soul-pack
Version: 0.1.0
The skill bundle is suspicious due to potential shell injection vulnerabilities in `scripts/export-soul.sh`, `scripts/import-soul.sh`, and `scripts/list-souls.sh`. While script variables are quoted, the scripts do not sanitize user-provided arguments (e.g., `--agent`, `--workspace`, `--dir`), making them vulnerable if the OpenClaw agent passes unsanitized input. Furthermore, `scripts/import-soul.sh` uses `tar -xzf` to extract packages, which is susceptible to path traversal attacks from malicious archives, potentially allowing arbitrary file writes despite the `--strip-components=1` flag. These vulnerabilities could lead to arbitrary command execution or file manipulation.
Capability Assessment
Purpose & Capability
The skill name/description describe exporting, importing, and listing SOUL packages and the included scripts implement exactly that. However the registry metadata claims no required binaries while the scripts and README require python3 and the openclaw CLI; that mismatch should be fixed (the binaries are reasonable for the stated purpose).
Instruction Scope
SKILL.md gives explicit shell invocation examples and the bundled scripts operate only on local filesystem artifacts (SOUL.md, preview.md, manifest.json) and call the local openclaw CLI. The instructions do not attempt to read unrelated files or environment variables, nor do they transmit extracted package contents to unexpected external endpoints. Examples use user-specific absolute paths but that is only illustrative.
Install Mechanism
This is an instruction-only skill with bundled scripts and no install spec or remote downloads. Nothing in the manifest writes code to disk from an external URL; risk from install mechanism is low.
Credentials
The skill declares no required environment variables or credentials, which aligns with local-only operation. Note: the scripts invoke the openclaw CLI which may itself use stored credentials/config in the user's environment to register agents or contact a remote service — this is expected for adding agents but is not declared in the metadata. No environment variables are read by the scripts directly.
Persistence & Privilege
The skill does not request permanent inclusion (always:false). The only persistent effect is that import-soul.sh may copy files into a workspace and call 'openclaw agents add' to register an agent — expected behavior for importing a package. The skill does not modify other skills or system-wide agent settings beyond creating/adding its own agent entry via the CLI.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install soul-pack - After installation, invoke the skill by name or use
/soul-pack - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Initial release: export/import soul package and auto-create agent
Metadata
Frequently Asked Questions
What is Soul Pack?
Export, import, and list SOUL packages for OpenClaw agents to manage reusable persona bundles and agent workspaces efficiently. It is an AI Agent Skill for Claude Code / OpenClaw, with 768 downloads so far.
How do I install Soul Pack?
Run "/install soul-pack" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Soul Pack free?
Yes, Soul Pack is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Soul Pack support?
Soul Pack is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Soul Pack?
It is built and maintained by juan-xin-cai (@juan-xin-cai); the current version is v0.1.0.
More Skills