Security audit

Agent Belief Discoverer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Live Neon integration, but it needs Review because it can upload user/source content and mutate an agent’s stored identity and future runtime prompt.

Install only if you are comfortable sending selected agent outputs, connected source content, and observations to Live Neon. Use a dedicated organization token, connect only authorized data sources, avoid raw user messages/secrets/personal data in observations, disable or avoid scheduled heartbeat automation unless explicitly approved, and manually inspect evidence before approving identity changes or using the generated prompt as a system instruction.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as passive belief discovery, but `/discover review` can approve, reject, star, and hide items, directly changing the agent's effective identity state. This is dangerous because users or autonomous agents may invoke it expecting analysis-only behavior while actually performing consequential state mutations that can alter future model behavior and governance.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The `/discover prompt` command fetches a runtime system prompt and instructs operators to use it as the system instruction for future interactions, which goes beyond observing outputs and instead steers model behavior. That mismatch increases the risk of hidden prompt injection into downstream sessions and makes the skill more powerful than its discovery-oriented framing suggests.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: `/discover observe` allows manual observations and source quotes to be injected directly into the discovery pipeline, contradicting the claim that beliefs are derived from real outputs alone. This can let agents or users seed arbitrary narratives into the identity-building system, contaminating the resulting beliefs and responsibilities.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The skill includes registration and account profile update flows, which are ancillary account-management capabilities not necessary for local belief discovery. Bundling account creation and profile changes into the skill expands attack surface and may cause users to disclose organizational or personal data to an external service unnecessarily.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The proactive trigger guidance recommends automatic invocation at session start, before generating content, after user correction, and before irreversible actions. Overly broad autonomous triggers can cause unintended external calls, excessive data sharing, and state changes without clear user intent or contextual necessity.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill encourages syncing and analyzing content from GitHub, websites, RSS, Twitter/X, and LinkedIn but does not foreground privacy, consent, data residency, or sensitive-content handling risks. This omission is dangerous because users may connect sources containing proprietary, personal, or regulated information without understanding what is transmitted and processed externally.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill explicitly instructs agents to submit user-derived observations and supporting quotes to an external platform. This creates a direct natural-language exfiltration path for conversation content, user preferences, and potentially sensitive or confidential data, especially because the examples include verbatim user quotes.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The proactive triggers and scheduled heartbeat normalize continuous logging of interactions, learned preferences, and observations to an external service. Persistent background reporting magnifies privacy risk, enables silent accumulation of sensitive context over time, and makes accidental data leakage much more likely than one-off manual use.

Static analysis

No suspicious patterns detected.