SOULSCANβ„’

Who's scanning your
agent's soul?

Your agent's skills are scanned. But the persona files that shape its behavior? SoulScan verifies AI persona packages for security, integrity, and quality.

65
Security Patterns
5
Scan Stages
80+
Souls Scanned
Scan from your terminal:
$ npx clawsouls soulscan ./my-soul/

5-Stage Security Pipeline

πŸ“‹
Stage 1: Schema Validation
Verifies soul.json structure β€” required fields, valid license, spec version.
πŸ“
Stage 2: File Structure Check
Validates file types, size limits (100KB/file, 1MB total), and recommended files.
πŸ”’
Stage 3: Security Scan
53 pattern checks: prompt injection (8 languages), code execution, XSS, secrets, PII.
✨
Stage 4: Content Quality
SOUL.md length, description quality, tag completeness, minimum quality bar.
🎭
Stage 5: Persona Consistency
Cross-validates SOUL.md, IDENTITY.md, and soul.json β€” name mismatches, contradictory tones.

What SoulScan Catches

βœ“ Prompt injection (8 languages)
βœ“ Code execution (eval, exec, system)
βœ“ XSS & HTML injection
βœ“ Secret/API key detection
βœ“ PII detection (context-aware)
βœ“ Harmful content (hate, CSAM)
βœ“ Privilege escalation (sudo, chmod)
βœ“ Social engineering patterns
βœ“ Persona consistency verification
βœ“ File integrity (SHA-256)

Scoring System

βœ“ Verified (90-100)
⚠ Low Risk (70-89)
● Medium (40-69)
● High Risk (1-39)
βœ• Blocked (0)