Neron

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This is a coherent personal knowledge graph connector, but it gives AI agents broad access to sensitive life data and mutation/delete powers without enough safeguards or consent guidance.

Install only if you are comfortable giving the connected agent access to your journal-like data, including mood, body, substance, relationship, task, and inferred pattern records. Use it with trusted agents only, protect the token/password, rotate the token if exposed, and require explicit confirmation before writes, ai_note auto-logging, raw Cypher queries, or any delete operation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states it has access to highly sensitive personal data including voice notes, moods, body states, activities, relationships, tasks, and AI-generated insights, yet it provides no user-facing warning, consent language, or privacy guardrails. In this context, the danger is elevated because the instructions encourage the agent to act as if it 'actually knows this person' and to continuously read, synthesize, and write back inferred insights, which can expose or amplify sensitive inferences about health, emotions, habits, and relationships.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · docs/CONNECT-AGENT.md (reported line 36)May include surrounding context.

md

| Agent | Config location |
|-------|----------------|
| OpenClaw | `~/.openclaw/workspace/config/mcporter.json` |
| Claude Code | `~/.claude/mcp.json` |
| Cursor | Settings → MCP → Add Server |

### 3. Load the skill

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes collection and automated inference of highly sensitive personal information including mood, body state, reflections, and life patterns, but does not warn users about privacy risks, retention, sharing boundaries, or downstream agent access. In a system designed to centralize intimate personal data, the absence of clear privacy and safety disclosures increases the likelihood of uninformed consent and unsafe use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises MCP tools with read, write, search, update, and delete capabilities for external agents, but does not clearly warn that connecting an AI agent grants it the ability to modify or remove a user's personal knowledge graph data. Because this product centers on sensitive life-logging data, undisclosed write/delete authority materially increases the risk of accidental or unauthorized data tampering through agent misuse, prompt injection, or operator misunderstanding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The tool list documents destructive operations such as delete_entity with cascading edge deletion, but does not clearly state that deletion may be irreversible or have broader graph-wide effects. In a personal knowledge graph storing sensitive longitudinal records, users or connected agents may underestimate the blast radius of destructive commands and permanently lose important data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is user-invocable and described in very broad terms as a 'Personal knowledge graph' that can record notes, moods, tasks, and patterns, without clearly constraining when it should activate or what sensitive operations it may perform. Broad invocation language increases the chance the agent will be used in contexts involving intimate personal data without sufficiently explicit user intent, leading to over-collection or unexpected access to sensitive graph contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document explicitly instructs users to give an AI agent read/write access to a personal knowledge graph, but it does not prominently warn that the agent can modify or create data. In this context, silent or misunderstood write access can lead to unintended persistence of sensitive personal information, corruption of records, or actions the user did not mean to authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The tool list includes a destructive capability, delete_entity, described as deleting entities and cascading to edges, but there is no adjacent warning about irreversible data loss or accidental agent misuse. Because this skill targets a personal knowledge graph, accidental deletions could erase important notes, tasks, relationships, or historical context with limited user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'Auto-logging' use case encourages the agent to write ai_notes passively whenever it spots insights, without clearly warning users that background data creation may occur continuously. In a personal-life tracking product, this can cause privacy issues, unwanted profiling, data pollution, and user confusion about what content was created by the agent versus the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs users to obtain a Telegram ID and password from a bot and enter them into a third-party connector flow, but it provides no warning about secure handling, credential sensitivity, rotation, phishing risks, or whether these credentials are app-specific and scoped. In a personal knowledge graph context, these credentials likely gate access to highly sensitive notes, mood data, tasks, and relationship information, so unsafe handling could expose private user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide encourages users to send free-form voice, text, and photo content while prominently advertising automatic extraction of highly sensitive attributes such as mood, body state, substance use, relationships, and implied tasks, but it does not warn users at the point of collection about the privacy sensitivity of this processing. In a personal knowledge graph context, users are likely to disclose intimate data casually, so the absence of an explicit warning or consent cue increases the risk of uninformed over-sharing and downstream privacy harm if the account, bot, or connected systems are compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The agent integration section promotes connecting external AI agents and references authentication methods, but it does not clearly warn that doing so grants autonomous access to a user's personal graph, which may contain intimate notes, inferred moods, health-related signals, substance-use data, and social relationship information. Because this product is explicitly designed to centralize sensitive life data, understated agent access materially raises the risk of users delegating broad access without understanding the scope or consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation exposes delete_entity for notes, tasks, people, projects, edges, and AI notes, including cascading deletion behavior, without any warning or confirmation guidance. In a personal knowledge graph context, accidental or induced deletion can cause irreversible loss of sensitive personal records and linked graph data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented cypher tool exposes raw Apache AGE graph-query capability that appears broader than the skill’s stated purpose of recording notes, tracking moods, and managing tasks. Because it accepts arbitrary query text and can return full relational data, it can enable wide, unbounded access to a user’s knowledge graph and may permit dangerous graph operations if the backend does not strictly enforce read-only semantics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The raw cypher capability is presented without warning that it enables broad traversal and potentially complete extraction of a personal knowledge graph, especially with minimal/moderate/full verbosity modes. In this skill’s context, the data includes intimate notes, moods, relationships, and reflections, so unrestricted graph queries materially increase privacy and overreach risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The instructions tool returns the full API reference and is framed as something to call once per conversation. For a skill presented as a personal knowledge graph for notes, moods, tasks, and pattern-spotting, exposing a dedicated API self-discovery mechanism is an agent-facing capability rather than an obvious end-user function.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.