NEON-SOUL - Self-Learning Soul Synthesis for AI Agents

• Outcome: Review
• Latest audit: May 28, 2026, 11:50 AM
• Version:
  0.4.5

Overview

This skill is locally focused, but it reads broader private conversation sources and can automatically commit generated identity data to git without clear user control.

Review this carefully before installing. Run only with data you are comfortable having summarized into identity files, avoid running it in a git repository unless you want SOUL.md committed, and prefer dry-run/custom paths until session-log and interview ingestion are clearly opt-in or disabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill includes backup, rollback, and repository-manipulation features that materially exceed the declared soul-synthesis scope. Those extra capabilities increase the blast radius of running the tool by enabling filesystem state changes and recovery workflows that are not necessary for identity extraction, making accidental or unauthorized modification more likely.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code runs `git add` and `git commit` automatically as part of the workflow, which is a privileged side effect unrelated to core synthesis. This can silently persist generated or sensitive content into version history, making rollback harder and potentially leaking private data to later pushes or collaborators.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill reads session logs from a separate agent sessions directory under `~/.openclaw/agents/main/sessions`, which goes beyond the stated memory-file extraction behavior. Pulling in broader conversational history widens data exposure and may ingest sensitive prompts or user content the operator did not expect to be analyzed.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The implementation ingests `USER.md`, interviews, existing `SOUL.md`, and session logs in addition to memory files, creating a scope mismatch between manifest and behavior. That discrepancy undermines informed consent and can cause the tool to process more personal or derived data than users intended.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill is marked user-invocable and described in broad, aspirational terms ('Automated soul synthesis for AI agents') without clearly constraining when it should be invoked or what inputs are in scope. In agent environments, vague trigger boundaries can cause unintended execution on sensitive workspace data such as memory files, leading to privacy-impacting overreach even if the implementation is not overtly malicious.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Session logs containing both user and assistant messages are read and transformed without any nearby runtime disclosure in the code path. Because session logs often contain highly sensitive conversational context, silent ingestion creates a privacy and surprise risk even if the feature is technically functional.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The pipeline persists synthesized outputs and multiple state/cache artifacts to disk, not just the main `SOUL.md`. Writing several files under `.neon-soul` and updating workspace state without prominent disclosure increases the chance of unexpected file modification and retention of sensitive derived data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The rollback API path can overwrite the current `SOUL.md` when invoked with `--force`, but there is no interactive disclosure or secondary safeguard in the programmatic path. This makes destructive restoration easy to trigger from automation or wrappers and could replace current content unexpectedly.

VirusTotal

64/64 vendors flagged this skill as clean.