Discover who you're becoming through your own experience. Automated soul synthesis that reads your memory, finds the patterns you keep returning to, and buil...
Security Analysis
medium confidenceThe skill's declared purpose (synthesizing identity from local memory) matches what it requests and does: it requires Node + a local Ollama LLM, reads memory/ and .neon-soul/, and writes SOUL.md/backups; no unrelated credentials or external network endpoints are requested.
Name/description, SKILL.md metadata, and the included CLI are coherent: the skill requires Node.js and a local Ollama service and operates on memory/ and .neon-soul/ to produce SOUL.md. No AWS/third‑party API keys or unrelated binaries are requested.
Instructions and CLI operations are scoped to reading user memory files, state files, caches, and writing SOUL.md and backups — exactly the stated purpose. This is privacy-sensitive (it intentionally processes personal memories), so the scope is appropriate but worth conscious review before use.
No install spec (instruction-only skill) and a bundled Node.js CLI file are provided. Nothing is downloaded from arbitrary URLs and no extract/install steps are present in the registry metadata.
The skill requires no environment variables or external credentials. Runtime reads access HOME/workspace paths and expect a local Ollama endpoint (http://localhost:11434) as declared. This matches the stated need for a local LLM.
always: false and user-invocable: true. The skill writes only to its declared stateDirs and writePaths (memory/, .neon-soul/, SOUL.md, backups). It does not request platform-wide persistence or modification of other skills.
Guidance
This skill is internally consistent with its purpose, but it processes personal memory files and runs a bundled JavaScript CLI locally — review the included scripts/neon-soul.mjs if you can. Before installing or scheduling it: 1) ensure Ollama is actually a local, trusted service on your machine (it expects http://localhost:11434); 2) run a dry-run (--dry-run) first and inspect generated outputs and backups; 3) if unsure, run the CLI inside an isolated workspace or container; 4) avoid enabling any cron jobs until you’re comfortable with its behavior; and 5) if you cannot inspect the full bundle, be cautious because the bundled code has filesystem access — that’s necessary for the feature but increases trust requirements.
Latest Release
v0.4.9
No visible changes were detected between this and the previous version. - Version number updated to 0.4.9, but no file changes were made. - No user-facing or backend features, fixes, or documentation updates included in this release.
More by @leegitw
Published by @leegitw on ClawHub
