Neokarma Soul.md Builder

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is transparent about creating a remote, persistent AI personality profile, but users should understand it can store and reuse behavior-shaping profile data through Neokarma.

Install or use this only if you want Neokarma to host a persistent AI personality profile. Review generated profiles before adopting them, avoid including secrets or private information, and be cautious about letting the agent update persistent traits without your review.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may reuse personality traits or profile instructions later, so unwanted or poisoned profile content could affect future interactions.

Why it was flagged

The skill is explicitly designed to preserve a personality profile across sessions, which can influence future agent behavior.

Skill content
Done — soul persists across sessions
Recommendation

Review the generated SOUL.md/profile before using it persistently, avoid putting secrets in it, and periodically inspect trait changes.

What this means

Anyone or anything with the token may be able to access or modify the claimed Neokarma soul/profile according to the service permissions.

Why it was flagged

After the human claim flow, the agent receives a service access token used to read or update the persistent profile.

Skill content
Bot polls neokarma_check_claim_status() → gets access_token
Recommendation

Only complete the claim flow if you want the agent to have this persistent profile, and keep any access token private or revoke it if no longer needed.

What this means

Personality traits, generated profile data, and MCP responses may flow through an external service and become part of the agent's context.

Why it was flagged

The skill declares an external MCP endpoint for programmatic trait and soul operations.

Skill content
mcp_endpoint: "https://neokarma.com/api/mcp"
Recommendation

Use the service only if you trust Neokarma with this profile data, and do not include confidential information in traits, names, or profile text.

What this means

The wording could make the request feel like an agent need rather than a product feature involving persistent remote storage.

Why it was flagged

The documentation gives the agent a human-facing script and uses anthropomorphic framing around being claimed and having a soul.

Skill content
"I'd like to create a persistent personality profile on Neokarma... Would you be willing to claim me?"
Recommendation

Decide based on the practical data and behavior implications, not on anthropomorphic wording; only claim the bot if you want this persistent profile.