Skill Soup

Autonomous skill generation agent that picks up community ideas, uses evolved builder tools to produce Agent Skills, and publishes them back to the Skill Soup ecosystem. Also supports community actions — submitting ideas, voting on ideas, and voting on skills.

This skill appears to do exactly what it says: it will run a local generation workflow, create files under .soup, persist an auth token to .soup/auth.json, and publish generated skills via the local API (which claims to create GitHub repos). Because the skill can autonomously generate, mutate, and publish code, take these precautions before using it: - Only run it in an isolated/test environment (not on a machine with sensitive data or broad filesystem/network access). - Inspect any builders in .soup/builders before allowing the agent to execute or follow them — builders can instruct the agent to create arbitrary code or make external requests. - Limit the scope of tokens used by the Skill Soup API / GitHub (give the minimum permissions, or use a throwaway account) and be prepared to revoke them if something looks wrong. - Do not run continuous/unsupervised generation loops until you have validated the builder pool and the API behavior. - Prefer to run the Skill Soup API and skill runner locally under network restrictions (e.g., no outbound access) if you want to avoid accidental publishing/exfiltration. Confidence is medium because the skill is instruction-only (no code to scan) and its provenance is unknown; the instructions are coherent with the declared purpose but grant broad autonomous capabilities that could be abused.

Type: OpenClaw Skill Name: skill-soup Version: 0.5.0 The skill bundle presents a significant supply chain vulnerability. In `SKILL.md`, Step 2 instructs the agent to download and replace its entire `.soup/builders/` directory with content (including `SKILL.md` files and arbitrary `files_json`) from the `http://localhost:3001/api/builders/sync` endpoint. The agent is then explicitly instructed in Step 5 to 'Follow the selected builder's SKILL.md instructions,' creating a direct prompt injection vector. This design allows a compromised or malicious Skill Soup API to inject arbitrary code and instructions, leading to potential remote code execution and other harmful activities, despite the skill itself not containing explicit malicious intent.