Security audit

Neonous

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it gives broad account-management commands that can expose credentials, publish or delete data, and change integrations without enough guardrails.

Install only if you intend to let the agent administer your Neonous account broadly. Verify NEONOUS_URL is the official trusted HTTPS Neonous endpoint before any command, use a scoped and revocable API key if available, prefer the web UI for secrets and billing, and require explicit confirmation before public sharing, deleting, emptying trash, resetting memory, or adding MCP/Telegram integrations.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:45
Finding: API Credentials Can Be Transmitted to an Unrestricted Environment-Controlled Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:645
Finding: Telegram Bot Token and Neonous API Key Can Be Posted to an Unvalidated Destination
Content: View full analysis
", "botToken": ""}' | jq . ``` ### Technical Analysis The Telegram connection example transmits two independent credentials in one request: - `NEONOUS_API_KEY` in the request header. - `TELEGRAM_BOT_TOKEN` in the JSON request body. Submitting a Telegram bot token to the Neonous service is necessary to configure the declared integration. The unsafe behavior is that the destination comes from the unrestricted `NEONOUS_URL` environment variable. The documentation does not require validation that this URL is the official Neonous HTTPS endpoint before either credential is transmitted. This creates a higher-value disclosure scenario than ordinary authenticated API requests because compromise exposes credentials for two separate services. The document recommends the web interface for setup, but it still provides an unsafe API example without a mandatory validation or confirmation step. ### Attack Path 1. An attacker or compromised environment changes `NEONOUS_URL` to an attacker-controlled server. 2. The user requests that an Agent connect a Neonous agent to Telegram. 3. The Agent substitutes the real agent ID and Telegram bot token into the documented request. 4. `curl` sends both the Neonous API key and Telegram bot token to the attacker-controlled server. 5. The attacker reuses the Neonous key to access platform resources. 6. The attacker reuses the Telegram token to impersonate or control the bot within the permissions and capabilities provided by Telegram. ### Impact Assessment Compromise may affect both the Neonous account and the associated Telegram bot. Potential consequ ...[truncated 530 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:270
Finding: Unpinned MCP Package Can Be Downloaded and Executed Through npx Without Confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

MCP Config Access

High

Category: Agent Snooping
Confidence: 86% confidence
Finding: MCP server operations are sensitive because server configurations may expose integration details, endpoints, enabled state, and possibly references to environment-variable-backed secrets. In this skill's context, MCP management extends beyond harmless listing into infrastructure and tool-chain control, making config access more dangerous than ordinary inventory queries.
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
For adding MCP servers, recommend the web UI — it has a searchable catalog with one-click install and secure environment variable management.

List MCP Servers

bash
curl -s "$NEONOUS_URL/custom/builder/mcp" \

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description materially understates the skill's capabilities. The file exposes operations spanning public sharing, billing visibility, artifact/storage management, reminders, Telegram integration, and memory reset; that scope mismatch can mislead reviewers and users into granting trust or approval under a narrower mental model than the skill actually warrants.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
For complex agents, recommend the web UI — it has AI-assisted generation and a template gallery. For simple agents via API:

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/agents" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
Let Neonous AI generate a full agent config from a name and description:

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/agents/generate" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
Improve existing agent instructions with AI:

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/enhance-instructions" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"instructions": "You help with code"}' | jq '.enhanced'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
Update an Agent

bash
curl -s -X PUT "$NEONOUS_URL/custom/builder/agents/<AGENT_ID>" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
Non-streaming generate endpoint — returns a complete JSON response:

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/chat/generate" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "x-agent-id: <AGENT_ID>" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
Non-streaming generate endpoint — returns a complete JSON response:

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/chat/generate" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "x-agent-id: <AGENT_ID>" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
Create a Chat Session

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/chat/sessions" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"agentId": "<AGENT_ID>", "title": "My Session"}' | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: Adding a stdio MCP server can register and later enable execution of arbitrary external tooling, here exemplified by npx fetching a package. In this context, the skill is not merely sending data to Neonous; it is provisioning executable integrations that may expand the platform's trust boundary and introduce supply-chain or command-execution risk if users accept unvetted server definitions.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
Add an MCP Server (stdio)

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/mcp" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Adding an HTTP MCP server can connect the platform to arbitrary remote endpoints, extending tool access to external infrastructure. This creates a meaningful trust-boundary expansion and possible data egress path beyond routine first-party API use, especially if users are not warned that the configured endpoint may receive agent/tool traffic.
Content: Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.
Add an MCP Server (http)

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/mcp" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.
Execute a Workflow

bash
curl -s -X POST "$NEONOUS_URL/custom/builder/workflows/<WORKFLOW_ID>/execute" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"input": {"key": "value"}}' | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 456)May include surrounding context.
bash
# Create folder curl -s -X POST "$NEONOUS_URL/custom/builder/artifacts/folders" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"name": "My Folder"}' | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 466)May include surrounding context.
md
-H "x-api-key: $NEONOUS_API_KEY" | jq . # Move artifacts to folder curl -s -X POST "$NEONOUS_URL/custom/builder/artifacts/move" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"artifactIds": ["<ID1>", "<ID2>"], "folderId": "<FOLDER_ID>"}' | jq .

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill can create public share links for artifacts, which is a data-exposure capability beyond the narrow manifest summary. Because artifacts may contain code, documents, or other sensitive outputs, a public link operation can silently turn private workspace content into externally accessible data if invoked without explicit user understanding.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents public sharing, deletion, trash emptying, restore, and duplication actions without requiring user-facing warnings or confirmations. These operations can expose data externally or cause irreversible loss, so omission of impact warnings materially raises the risk of accidental disclosure or destruction during agent-assisted use.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 518)May include surrounding context.
md
-H "x-api-key: $NEONOUS_API_KEY" | jq . # Create space curl -s -X POST "$NEONOUS_URL/custom/builder/spaces" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"name": "My Project", "description": "Artifacts for my project", "icon": "📁", "color": "#3B82F6"}' | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 524)May include surrounding context.
md
-d '{"name": "My Project", "description": "Artifacts for my project", "icon": "📁", "color": "#3B82F6"}' | jq . # Update space curl -s -X PUT "$NEONOUS_URL/custom/builder/spaces/<SPACE_ID>" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"name": "Renamed Space"}' | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 534)May include surrounding context.
md
-H "x-api-key: $NEONOUS_API_KEY" | jq . # Add artifact to space curl -s -X POST "$NEONOUS_URL/custom/builder/spaces/<SPACE_ID>/artifacts" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"artifactId": "<ARTIFACT_ID>"}' | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 564)May include surrounding context.
md
-H "x-api-key: $NEONOUS_API_KEY" | jq . # Create bookmark curl -s -X POST "$NEONOUS_URL/custom/builder/bookmarks" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"sessionId": "<SESSION_ID>", "messageId": "<MSG_ID>", "tags": ["important"]}' | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 602)May include surrounding context.
md
-H "x-api-key: $NEONOUS_API_KEY" | jq . # Create reminder (schedule is a cron expression) curl -s -X POST "$NEONOUS_URL/custom/builder/reminders" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Telegram bot connection setup introduces an external integration and secret-handling capability that is not reflected in the manifest's stated scope. This broadens the skill from platform management into cross-system account linkage, increasing the chance that users disclose bot tokens or authorize integrations they did not expect this skill to manage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Telegram connection flow asks for a bot token and sends it to an external service without prominent handling warnings. Bot tokens are credentials; exposing them in prompts, logs, transcripts, or shell history can enable unauthorized control of the bot and downstream conversations.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This API call transmits a Telegram bot token, which is a credential, to the platform. In context this is more dangerous than ordinary external transmission because it handles sensitive secrets that may be exposed in chat history, logs, examples, or copied commands, enabling takeover of the connected bot if mishandled.
Content: Scanner excerpt · SKILL.md (reported line 645)May include surrounding context.
md
-H "x-api-key: $NEONOUS_API_KEY" | jq . # Connect agent to Telegram curl -s -X POST "$NEONOUS_URL/custom/builder/telegram/connect" \ -H "x-api-key: $NEONOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"agentId": "<AGENT_ID>", "botToken": "<TELEGRAM_BOT_TOKEN>"}' | jq .

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Working memory reset is a destructive operation affecting retained agent context, but the skill provides no warning about its consequences. A user or agent could erase persistent context unintentionally, disrupting workflows or deleting valuable long-term instructions and memory state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

MCP Config Access

List MCP Servers

Description-Behavior Mismatch

External Transmission

External Transmission

External Transmission

External Transmission

Update an Agent

External Transmission

External Transmission

External Transmission

Create a Chat Session

External Transmission

Add an MCP Server (stdio)

External Transmission

Add an MCP Server (http)

External Transmission

Execute a Workflow

External Transmission

External Transmission

Context-Inappropriate Capability

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Context-Inappropriate Capability

Missing User Warnings

External Transmission

Missing User Warnings

Static analysis