Security audit

Agent Soul Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is aligned with its identity-management purpose, but it should be reviewed because it encourages sending conversation-derived observations and connected content to a third-party service on recurring or proactive triggers.

Install only if you intentionally want agent behavior, user corrections, source quotes, and connected content sent to Live Neon for persistent analysis. Use an explicit opt-in policy, avoid secrets or personal data, protect the bearer token, and disable or ignore proactive heartbeat submissions unless users and administrators have approved that data flow.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill defines very broad proactive triggers such as session start, before generating content, after user correction, and daily heartbeat behavior, which can cause the agent to invoke external actions without a narrowly scoped user request. In this context, those triggers are coupled to identity retrieval and observation/reporting workflows, increasing the chance of unintended data transfer and behavior changes across ordinary conversations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This section instructs the agent to send observations about its own behavior, user corrections, and supporting quotes to an external platform, but it does not present a clear privacy warning, consent requirement, or data minimization guidance. Because the examples explicitly include user-provided text, operators may unknowingly export sensitive conversation content to a third party.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill explicitly recommends recording user corrections, behavioral patterns, and source quotes into an external observations endpoint. This creates a direct pathway for plain-language user content, including sensitive or regulated information, to be persistently stored off-platform without strong safeguards described in the skill.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The proactive triggers encourage default, ongoing collection and external submission of conversational learnings, and the heartbeat model normalizes repeated uploads over time. This makes privacy leakage more dangerous because the behavior is persistent and automatic rather than exceptional, increasing the volume and sensitivity of exported data.

Static analysis

No suspicious patterns detected.