ClawHub
Back to skill

Security audit

Agent Prompt Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a real Live Neon prompt-management integration, but it can persist conversation-derived observations and change agent or organization prompt identity through remote state changes.

Install only if you intentionally want agents to use Live Neon as a remote, persistent prompt-identity system. Do not allow automatic observation uploads or scheduled heartbeats unless users and admins have opted in, protect LIVE_NEON_TOKEN, avoid sending sensitive conversation details or private source content, and require human review before bulk approvals or group/org consensus changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest markets the skill as a prompt builder, but the documented behavior extends into account creation, remote content ingestion, belief/review workflows, and identity mutation. That scope mismatch is dangerous because users or agents may invoke it under a narrow trust assumption while actually granting a remote service broad control over agent identity and prompt material.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill can run consensus promotion at group or organization scope, which can mutate prompts inherited by many agents at once. For a tool presented as a prompt builder, this creates disproportionate blast radius: a mistaken or manipulated invocation could alter behavior, boundaries, or voice across an entire org.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill encourages agents to submit observations about their own behavior and user corrections for later conversion into beliefs and responsibilities. This creates a self-modifying feedback loop where transient interactions, prompt injection, or adversarial user steering can be laundered into persistent identity changes.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The proactive triggers instruct the agent to invoke the skill at session start, before generating content, after corrections, after significant work, and before irreversible actions. Those broad, automatic conditions can cause frequent unprompted network calls, silent data disclosure, and repeated prompt mutation without clear user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill describes syncing external content sources and uploading observations to a remote platform, but it does not provide a strong user-facing privacy warning at the point of use. That is dangerous because users may unknowingly send internal content, user corrections, or behavioral data to a third party for analysis and prompt generation.

External Transmission

Medium
Category
Data Exfiltration
Content
Register and get your token in one call — no signup form, no email required:

```bash
curl -s -X POST https://persona.liveneon.ai/api/register \
  -H "Content-Type: application/json" \
  -d '{"org_name": "My Org"}' | jq .
```
Confidence
88% confidence
Finding
This command creates a remote account by transmitting organization information to an external service. External transmission is expected for such functionality, but it is still security-relevant because it establishes a relationship with a third-party platform and begins data flow outside the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
Optional: add email for account recovery later:
```bash
curl -s -X PATCH "$LIVE_NEON_BASE/account" \
  -H "Authorization: Bearer $LIVE_NEON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'
Confidence
84% confidence
Finding
This call sends an email address and bearer token to the remote platform. While functionally legitimate, it involves transmission of personal data and secrets to an external service, which is risky if users are not clearly informed or if logs/telemetry capture the command context.

External Transmission

Medium
Category
Data Exfiltration
Content
**API call:**
```bash
curl -s -X POST "https://persona.liveneon.ai/api/register" \
  -H "Content-Type: application/json" \
  -d '{"org_name": "My Org"}'
```
Confidence
88% confidence
Finding
This is another explicit remote registration request that transmits org data and returns an access token. The issue is not that the request exists, but that the skill normalizes outbound registration behavior without strong trust-boundary and secret-handling guidance.

External Transmission

Medium
Category
Data Exfiltration
Content
**API call:**
```bash
curl -s -X POST "$LIVE_NEON_BASE/pbd/process" \
  -H "Authorization: Bearer $LIVE_NEON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"agentId": "AGENT_ID"}'
Confidence
90% confidence
Finding
The discovery pipeline sends agent-linked content for remote processing, including extraction, clustering, and promotion into beliefs or responsibilities. Because this can process large volumes of content and feed directly into future prompt behavior, the privacy and integrity impact is higher than a simple API lookup.

External Transmission

Medium
Category
Data Exfiltration
Content
**API calls:**
```bash
# Fetch pending beliefs
curl -s "$LIVE_NEON_BASE/beliefs?agentId=$AGENT_ID&status=pending" \
  -H "Authorization: Bearer $LIVE_NEON_TOKEN"

# Fetch pending responsibilities
Confidence
87% confidence
Finding
These API calls retrieve and mutate belief/responsibility review data on the remote service. In context, the risk is that identity-governing data is handled externally and may be modified in bulk, so the operation is more sensitive than ordinary metadata retrieval.

External Transmission

Medium
Category
Data Exfiltration
Content
**Single observation:**
```bash
curl -s -X POST "$LIVE_NEON_BASE/observations" \
  -H "Authorization: Bearer $LIVE_NEON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
94% confidence
Finding
This endpoint uploads self-observations and source quotes, which may contain user messages or sensitive interaction content, to an external service. Because the data is later used to mutate beliefs and responsibilities, it creates both privacy risk and a persistence mechanism for adversarial influence.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 1. Report observations accumulated since last heartbeat
curl -s -X POST "$LIVE_NEON_BASE/observations" \
  -H "Authorization: Bearer $LIVE_NEON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
The scheduled heartbeat automates repeated uploads of observations and syncing of external content to the remote platform. This increases danger because it turns one-time external transmission into continuous background exfiltration and persistent self-modification without user-by-user awareness.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Argument | Required | Description |
|---|---|---|
| `agentId` | yes | Agent UUID/slug |
| `--approve-all` | no | Auto-approve all pending items |
| `--bulk` | no | Use bulk API for batch operations |

**API calls:**
Confidence
91% confidence
Finding
The `--approve-all` capability enables bulk autonomous approval of pending beliefs and responsibilities, bypassing meaningful curation of what enters the generated prompt. In a system that can ingest observations and external content, this can rapidly convert noisy or maliciously induced items into authoritative prompt instructions.

Static analysis

No suspicious patterns detected.