NEUS Trust Workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited NEUS Trust Workflow (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
NEUS gives agents verifiable identity, scoped authority, and receipts for every trusted action. Verify trust before your assistant runs tools.
Install the NEUS CLI:
npm i -g @neus/sdk
neus setup
neus checkOr try without installing:
npx -y -p @neus/sdk neus setupneus setup configures hosted NEUS MCP for Cursor, Codex, VS Code, and Claude Code. Cursor, VS Code, and Claude Code use browser OAuth. Codex uses its own MCP login after setup.
Codex-only:
neus setup --client codex
neus auth --client codexServers and CI:
neus setup --access-key <npk_...>Create access keys under Account → Access keys on neus.network. Never paste keys into chat or committed files.
Hosted MCP: `https://mcp.neus.network/mcp`
Trust receipts persist offchain by default. Do not prompt for wallet connection or on-chain anchoring unless the user explicitly asks; only then pass options.publishToHub: true on verify.
After MCP is connected on the machine, mount an agent into a project:
neus mount <agentId> --apply cursorUse neus mount only when acting as a registered profile agent in a project. For general MCP trust workflow (verification, receipts, secrets), neus setup + neus_context is enough.
| Layer | Command |
|---|---|
| Machine | neus setup + neus auth (once) |
| Repo | neus mount <agentId> --apply cursor |
| Session | neus_context → neus_agent_mount when acting as the agent |
neus mount <agentId> --apply cursor in the project) — identity, delegation, and scoped policy in one bundle.Summarize NEUS results in plain language. Do not dump raw tool JSON, MCP details, or implementation field names.
Passed:
NEUS Verify
Status: Passed
Requirement: Identity and permission check
Receipt: Existing trust receipt accepted
Next: ContinueAction needed:
NEUS Verify
Status: Action needed
Missing: Sign-in
Next: Connect NEUS, then retryBlocked:
NEUS Verify
Status: Blocked
Reason: Required trust condition was not satisfied
Next: Do not continue until verification is completeUse real receipt identifiers only — take them from tool responses, never invent them.
https://neus.network/proof/<qHash>Never invent qHashes, verifier IDs, or receipt fields.
neus.network) consumes protocol state — do not duplicate verifier schema in client apps.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.