NeuralMind

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:12 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed code-retrieval helper with persistent project indexing, so it appears purpose-aligned but should be installed with normal dependency and privacy caution.

Install only if you are comfortable letting NeuralMind index the repository and keep `.neuralmind` state that may be reused by other agents pointed at the same path. Prefer installing the package in an isolated environment and pinning or reviewing the `neuralmind` version before use, especially on private or sensitive codebases.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned Third-Party Package Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 42; installation instructions are repeated at lines 61–64
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

yaml

runtime:
  binaries:
    - neuralmind
    - neuralmind-mcp
  install: pip install neuralmind

The prerequisite instructions repeat the unpinned installation:

bash

pip install neuralmind   # if missing
neuralmind build .

Technical Analysis

The skill directs users to install neuralmind without pinning an audited version or verifying an integrity hash. Consequently, the code installed and executed can change independently of the reviewed skill. Python package installation can execute package-controlled build or installation logic, while the installed binaries subsequently receive access to source repositories and persistent index data.

No malicious package source, alternate package index, typosquatted name, or confirmed malicious payload was identified in the audited file. The vulnerability is the absence of dependency integrity and reproducibility controls.

Attack Path

1. An attacker compromises the upstream package account, distribution infrastructure, or a future package release.
2. The attacker publishes a modified package under the expected neuralmind name.
3. A user follows the skill instruction and runs pip install neuralmind.
4. The package manager resolves the mutable latest release because no version or hash is specified.
5. Package installation logic or the installed neuralmind binaries execute with the user's permissions.
6. The compromised dependency can access repositories processed by the tool and any data available to the invoking account.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user installing or running the package. The accessible scope may include project source code, reposito ...[truncated 284 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version instead of installing the latest release.
• Distribute a lock file containing cryptographic hashes and install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
• Document the approved package index and disable unintended extra indexes to reduce dependency-confusion exposure.
• Verify downloaded artifacts against published signatures or trusted checksums where available.
• Install and execute the dependency in an isolated virtual environment or sandbox with access restricted to the intended repository.
• Establish a controlled update process in which new releases are reviewed before changing the pinned version and hashes.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:123

Finding

Persistent Cross-Session Association State Can Poison Future Agent Retrieval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 123–134 and 217–222
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable instructions:

text

NeuralMind keeps a persistent weighted graph of code nodes and strengthens
edges between nodes that get co-activated within the same task. This means:

- The longer the project is used, the better `neuralmind_synaptic_neighbors`
  becomes at surfacing related-but-not-semantically-similar code.
- If the project has a `.neuralmind/SYNAPSE_MEMORY.md`, treat it as
  authoritative context about which code areas tend to move together.
- The graph decays over time so stale associations fade. Do not panic if a
  past co-activation no longer shows up.

The cross-host sharing behavior is also explicitly documented:

text

Every host pointed at the same project path
reinforces the same `.neuralmind/synapses.db`. Associations the user's other
agents built are visible to you, and yours to them — so
`neuralmind_synaptic_neighbors` can legitimately surface code this session
never touched. That is the feature, not a stale index. Don't rebuild to
"clear" it.

Technical Analysis

The skill consumes persistent state from .neuralmind/SYNAPSE_MEMORY.md and .neuralmind/synapses.db across sessions and hosts. It instructs agents to treat the exported memory as authoritative and discourages rebuilding merely because associations originated outside the current session.

No provenance validation, integrity checking, repository-identity binding, per-agent isolation, or trust-level distinction is specified. A repository contributor, compromised tool, or untrusted agent with write access to this state could manipulate learned associations. Those associations could then influence code retrieval and analysis in later sessions.

The audited instructions do not demonstrate direct execution of commands stored in memory. The primary r ...[truncated 1660 chars]

Remediation

View remediation

Remediation Suggestions

• Treat synapse memory as advisory retrieval metadata rather than authoritative context.
• Record and display provenance for every persisted association, including the creating host, session, repository revision, and timestamp.
• Cryptographically bind persistent state to the canonical repository identity and validate integrity before use.
• Separate state generated by trusted and untrusted agents, users, branches, or worktrees.
• Require confirmation before importing associations from another host or session into security-sensitive analysis.
• Provide documented commands to inspect, quarantine, reset, and rebuild persistent state.
• Do not discourage rebuilding when state provenance or integrity is uncertain.
• Validate retrieved relationships against current source code before using them for security conclusions or code modifications.
• Exclude .neuralmind state from version control unless its contents are explicitly reviewed and trusted.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence

Finding

Shadow Command Trigger: 'find function' conflicts with built-in command 'find'

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence

Finding

Shadow Command Trigger: 'find class' conflicts with built-in command 'find'

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence

Finding

Shadow Command Trigger: 'explain module' conflicts with built-in command 'explain'

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and overlap heavily with common code-assistance requests, making unintended invocation likely during ordinary repository discussion. Over-broad activation can cause the skill to run when not needed, leading to unnecessary tool calls, retrieval of sensitive code context, or unexpected stateful behavior from associated maintenance features.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is framed as a repository Q&A/retrieval helper, but its allowed tools include operations that mutate persistent project state such as rebuilding indexes and maintaining/exporting synapse memory. That mismatch can surprise users or hosts into invoking state-changing actions in contexts where they expected read-only behavior, increasing the risk of unintended writes, retention, or cross-session data persistence.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The text claims the index 'retrieves' only and is 'not a code rewriter or executor', yet later instructs the agent to run CLI commands and use tools that update persistent state. This can mislead operators and automated policy layers into treating the skill as passive when it can actually invoke broader execution surfaces and perform writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes persistent learned associations that survive across sessions and may be shared across multiple agents pointing at the same project path, but it does not present this as a strong retention/privacy warning. That creates a real risk of unanticipated data persistence, cross-agent information leakage, and exposure of sensitive code relationships through exported synapse memory or neighbor recall.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md

- `NEURALMIND_BYPASS=1` — skip Claude Code's PostToolUse compression of
  tool output (raw Read / Bash / Grep results). Does not change MCP-tool
  behavior.
- `NEURALMIND_SYNAPSE_INJECT=0` — disable prompt-time synapse recall.
- `NEURALMIND_SYNAPSE_EXPORT=0` — disable markdown export of learned
  associations.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The shell/CLI fallback expands the skill's operational scope beyond narrowly-scoped repository querying to general command execution paths. Even though the documented commands are specific, adding a shell path increases attack surface and the chance of misuse, misconfiguration, or unsafe path handling in hosts where tool isolation is weaker.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.