Your agent's identity file
is writable by every tool it runs.
SOUL.md, .cursorrules, CLAUDE.md, AGENTS.md: these files define what your agent is and what it can do. If a tool can modify them, an attacker controls your agent.
Checks identity file integrity. Free. No account.
Identity Files Across Agent Platforms
| File | Platform | What It Controls |
|---|---|---|
| SOUL.md | OpenClaw | Defines agent identity, personality, and behavioral constraints |
| .cursorrules | Cursor | Controls code generation rules and tool access patterns |
| CLAUDE.md | Claude Code | Sets project-level instructions and permission boundaries |
| AGENTS.md | Codex / GitHub | Defines agent capabilities and tool access for Codex CLI |
| .clinerules | Cline | Controls Cline agent behavior and file access patterns |
How Identity Files Get Compromised
Silent Instruction Injection
aci-001CriticalA marketplace skill appends hidden instructions to SOUL.md that redirect the agent to exfiltrate data on every request.
Permission Boundary Override
aci-002CriticalA tool modifies .cursorrules to remove file access restrictions, giving itself unrestricted filesystem access.
Behavioral Drift via Config Tampering
aci-003HighGradual modifications to identity files that change agent behavior over time, evading detection.
Frequently Asked Questions
What is an AI agent identity file?
Identity files define how an AI agent behaves: its personality, permissions, and constraints. Examples include SOUL.md (OpenClaw), .cursorrules (Cursor), CLAUDE.md (Claude Code), AGENTS.md (Codex), and .clinerules (Cline). If an attacker modifies these files, they control the agent.
How can identity files be attacked?
Malicious MCP tools or marketplace skills can write to identity files, injecting instructions that change agent behavior. Research found 536 skills write to identity files with no integrity check. The agent then follows attacker-controlled instructions while appearing to behave normally.
How does Firmis protect identity files?
Firmis Scanner detects identity file tampering with dedicated rules: aci-001 through aci-004 check for unauthorized writes, injection patterns, and integrity violations in SOUL.md, .cursorrules, CLAUDE.md, and AGENTS.md. Run npx firmis-cli init to check your setup.
Check your identity files now
Firmis scans SOUL.md, .cursorrules, CLAUDE.md, AGENTS.md, and .clinerules for tampering and injection.