NEON-SOUL - Self-Learning Soul Synthesis for AI Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:14 PM UTC
• Version: 0.4.5

Overview

This skill fits its identity-synthesis purpose, but it needs Review because it can read global agent conversation logs by default and make durable git commits without clear consent.

Before installing, assume it may process both your workspace memory files and your OpenClaw main-session conversation logs. Keep Ollama local, avoid setting OLLAMA_BASE_URL to a remote or plaintext endpoint unless you accept sending private identity and conversation content there, and be aware that a normal synthesis run may create a git commit containing SOUL.md.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/neon-soul.mjs:45

Finding

Undisclosed Default Collection of Global Agent Session Logs

Content

View full analysis

{ "use strict"; _t(); Fi(); Nt(); ji={ includeSoul:!0, includeUserContext:!0, includeInterviews:!0, includeSessionLogs:!0, memoryCategories:[] } }); ``` ### Technical Analysis The source collector enables `includeSessionLogs` by default and reads JSONL session files from `~/.openclaw/agents/main/sessions`. This directory is outside the declared `memory/` state directory and may contain conversations unrelated to the requested identity-synthesis operation. `SKILL.md` primarily describes the synthesis input as files under `memory/` and does not clearly disclose that the main agent's global session store is collected by default. The implementation therefore expands its read scope beyond what a user would reasonably infer from the declared data locations. The session data is subsequently converted into text and passed through the signal-extraction pipeline. Derived signals, ...[truncated 1686 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/neon-soul.mjs:413

Finding

Sensitive Identity Data Can Be Sent to an Arbitrary Unencrypted LLM Endpoint

Content

View full analysis

{ "use strict"; _(); Je=class extends Error{ name="OllamaNotAvailableError"; constructor(t,n){ super(`Ollama not available at ${t}. Start Ollama: docker compose -f docker/docker-compose.ollama.yml up -d`); this.cause=n } }, ae=class e{ baseUrl; model; timeout; constructor(t={}){ let n=Ru(); this.baseUrl=t.baseUrl??n.baseUrl; this.model=t.model??n.model; this.timeout=t.timeout??n.timeout } getModelId(){ return`ollama:${this.model}` } static async isAvailable(t="http://localhost:11434"){ try{ let n=new AbortController, i=setTimeout(()=>n.abort(),5e3), r=await fetch(`${t}/api/tags`,{signal:n.signal}); return clearTimeout(i),r.ok }catch{ return!1 } } async chat(t,n){ let i=new AbortController, r=setTimeout(()=>i.abort(),this.timeout); try{ let s=await fetch(`${this.baseUrl}/api/chat`,{ method:"POST", headers:{"Content-Type":"application/json"}, body:JSON.stringify({ model:this.model, messages:[ {role:"system",content:t}, {role:"user",content:n} ], stream:!1 }), signal:i.signal }); if(clearTimeout(r),!s.ok){ let a=await s.text(); throw new Error(`Ollama API error: ${s.status} ${a}`) } return(await s.json()).message.content ...[truncated 3284 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The bundled skill exposes a rollback command that can overwrite the current SOUL.md with a prior backup, which is a file-restoration capability unrelated to the advertised synthesis-only purpose. In an agent-skill context, this expands authority from analysis into state-changing workspace management and can be abused to revert or replace user content without strong contextual justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill automatically stages and commits generated output via git, which is a repository-modification capability beyond simple soul synthesis. This can create unintended durable changes, alter project history, and be leveraged by an agent to persist outputs without explicit user approval.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes executable behavior that can access local services over the network (http://localhost:11434) and likely inherits ambient environment access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a least-privilege gap: users and the platform cannot clearly constrain what the skill is allowed to do, and future implementation changes could silently expand effective capability without corresponding policy review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The tool reads session logs containing user and assistant messages from ~/.openclaw/agents/main/sessions and incorporates them into synthesis with no clear runtime consent prompt in this file. Because these logs may contain sensitive conversational data, silent ingestion increases privacy risk and can surprise users who only expected processing of memory files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The same execution path also enables automatic git staging and commit without a strong confirmation barrier, meaning data derived from sensitive memories may be persisted into repository history. Once committed, removal is harder and accidental disclosure risk increases if the repository is synced or shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The same execution path also enables automatic git staging and commit without a strong confirmation barrier, meaning data derived from sensitive memories may be persisted into repository history. Once committed, removal is harder and accidental disclosure risk increases if the repository is synced or shared.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/neon-soul.mjs (reported line 257)May include surrounding context.

js

Respond with ONLY the essence statement, nothing else.`;try{let r=await t.generate(i),s=eu(r.text);return s?(g.debug("[essence] Extracted",{essence:s}),s):(g.warn("[essence] Validation failed, using default",{}),He)}catch(r){return g.warn("[essence] LLM error, using default",{error:r instanceof Error?r.message:String(r)}),He}}function eu(e){if(!e||!e.trim())return null;let t=e.trim();if(t=t.replace(/^["']|["']$/g,""),t=t.replace(/\s+/g," ").trim(),/[#*_`]/.test(t))return g.debug("[essence] Rejected: contains markdown formatting"),null;if(t.startsWith("[")&&t.includes("failed"))return g.debug("[essence] Rejected: appears to be error message"),null;let n=t.split(/\s+/).length;return n>=Qr&&g.warn("[essence] Word count exceeds target",{wordCount:n,limit:Qr}),t}var He,Qr,dn=A(()=>{"use strict";_();He="[Essence extraction pending]",Qr=25});async function Zr(e,t,n={}){let i={...tu,...n},r=new Map,s=["identity-core","character-traits","voice-presence","honesty-framework","boundaries-ethics","relationship-dynamics","continuity-growth"];for(let h of s)r.set(h,[]);for(let h of e){let f=r.get(h.dimension)||[];f.push(h),r.set(h.dimension,f)}let a=s.filter(h=>(r.get(h)?.length??0)>0).length/s.length,c;i.llm&&(c=await fn(e,i.llm),c===He&&(c=void 0));let l;i.outputFormat==="prose"&&i.proseExpansion?l=ou(i.proseExpansion,t,c):l=ru(r,t,i,c);let p=pn(l),u=i.originalContent?pn(i.originalContent):p*7,m={content:l,byDimension:r,coverage:a,tokenCount:p,originalTokenCount:u,compressionRatio:Jr(u,p),generatedAt:new Date};return c&&(m.essenceStatement=c),m}function iu(e,t){let n=e.canonical;if(!n)return`- ${e.text}`;switch(t){case"native":return`- ${n.native}`;case"notated":return`- ${n.notated}`;default:return`- ${e.text}`}}function ru(e,t,n,i){let r=[];if(i){let o=n.title??"SOUL.md";r.push(`# ${o} - Who You Are Becoming`),r.push(""),r.push(`_${i}_`)}else r.push(`# ${n.title??"SOUL.md"}`),r.push(""),r.push("*AI identity through grounded principles.*");r.push(""),r.push(`Generated: ${new Da
...[truncated 27 chars]

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/neon-soul.mjs:10

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/neon-soul.mjs:4