Neshama Soul Engine

PassAudited by ClawScan on May 12, 2026.

Overview

This instruction-only personality/prompt skill is coherent and disclosed, but using it may send chat content and identifiers to Neshama's API and may require an API key.

This skill appears benign and instruction-only. Before using it, confirm you are comfortable sending message content and session/user identifiers to api.neshama.pw, protect any API key you obtain, and review generated personality prompts so they do not override your intended task or safety expectations.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

The assistant may adopt generated personality or behavior guidance during conversations.

Why it was flagged

The skill's core function is to create prompts that shape the agent's behavior. This is expected for a personality engine, but users should understand it can influence tone and response style.

Skill content
📝 **上下文生成**:自动生成 LLM 友好的人格提示词
Recommendation

Use generated personality context as style guidance only, and do not let it override explicit user requests, higher-priority instructions, or safety policies.

What this means

A Neshama API key may grant access to the user's service account or quota.

Why it was flagged

The API requires an API key, which is expected for this service but is not declared as a required credential in the registry metadata.

Skill content
| **认证** | API Key(在 neshama.pw 获取) |
Recommendation

Store the API key securely, avoid pasting it into shared chat logs, and revoke or rotate it if it is exposed.

What this means

Conversation text and identifiers may leave the local agent environment and be processed by Neshama's service.

Why it was flagged

The documented workflow sends user message content and session/user identifiers to an external provider API.

Skill content
POST https://api.neshama.pw/v1/soul/compute ... "message": "用户的消息内容", ... "session_id": "会话ID", "user_id": "用户ID"
Recommendation

Avoid sending sensitive personal or confidential content unless you trust the provider and its privacy practices; use pseudonymous session/user IDs where possible.