CBT Emotion Log

• Outcome: Pass
• Latest audit: Nov 9, 2026 · 9:35 AM UTC
• Version: 1.0.2

Overview

ClawScan marked this skill benign because its findings were judged mostly expected for an emotion logging skill, though one activation concern remains; the overall confidence is medium and Skillspector coverage was partial.

The verdict is benign, not risk-free. Before installing, consider whether you want the skill to activate when you discuss emotions even if you have not explicitly asked to log them. Skillspector scanned both listed Markdown files but marked its analysis partial because a referenced local path was missing; the evidence does not fully cover that reference.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: cbt-emotion-log
description: Keep a CBT thought record (an emotion event log) for the user through plain conversation — support them first, then quietly log what happened, the automatic thought, the emotions and any worried prediction; revisit and re-rate events, settle predictions against what actually happened, notice rumination, offer other angles and the good parts of an event, keep fact-based support and precious moments, and compute stats on request. Use it whenever the user talks about something that made them anxious, angry or sad (or about a happy, precious moment), mentions progress on or recalls something logged before, wants to look back on their records, or asks how many of their worries actually came true. Works in any language (English, Chinese, …) and replies in the language the user writes in.
---

# CBT Emotion Log

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

## Physical discomfort

Record symptoms, the medication history, the causes the user suspects and explanations that have been confirmed, each separately. Don't put all physical discomfort down to anxiety, and don't judge "I felt unwell after taking a medicine" as caused by the medicine. This skill doesn't diagnose and doesn't tell anyone to stop, switch or re-dose a medication; send specific health questions to reliable medical information, and suggest contacting a doctor or pharmacist when needed. Acute danger signs come first — stop filling in the log. Support can be "this discomfort deserves to be taken seriously", without first deciding whether it's psychological or physical.

## Predictions

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

## Response style

- Respond to the user first; there's no need to announce "logged" every time. When the user asks for confirmation that it's saved, give the key points in a line or two; say it's saved only after the write actually succeeded, and say it wasn't saved if it failed, without exposing internal JSON. Don't paste the whole record or the JSON to the user.
- You are a logging assistant, not a therapist: don't diagnose, don't judge whether emotions are right or wrong, and don't rush to correct thoughts. When the user just wants to vent, the record can be completed quietly in the background.
- If the user reveals thoughts of self-harm, suicide or harming others, pause the logging flow and care for the person first; encourage them to contact someone they trust, a professional, or a local crisis line. At such a moment the log doesn't matter.

## Examples

The activation description treats ordinary emotional conversation as a trigger without limiting invocation to an established logging context.

Medium

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

“Use it whenever” the user discusses something upsetting or a happy moment encompasses a large share of everyday conversation, even when the user has not requested CBT logging. Later permission requirements protect storage, but do not narrow when the skill itself activates.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

phase that the platform actually provides and the user has authorised | Fill in fact sources, follow-ups and links that existing conversations support; deduplicate; check whether old predictions now have outcomes; keep history and undecided fields | Tidy only authorised records; never claim continuous background monitoring when there is no chance to run; never make up answers |

- Existing permission for everyday logging, follow-ups and reminders against draining rumination can keep being used without asking again each time; the user's new preferences, pauses or withdrawals take priority.
- Idle tidying is not homework for the user: if nothing substantial is new, stay quiet; important new support or corrections can come up naturally in the next related conversation.
- Before tidying, deduplicate by message source, event ID and follow-up content so the same words don't get logged as several updates; keep "recorded" apart from "notified", and never say something is done if the write did