Security audit

Emotional Guidance Companion

Security checks for vulnerabilities and agentic risk

Overview

This skill is a text-only emotional support guide with clear limits and no hidden execution, data access, or persistence.

Installers should treat this as supportive reflection, not therapy or emergency care. Use it where users knowingly want emotional support, keep crisis handling tied to local resources and real human escalation when available, and do not rely on it for diagnosis, medication, or legal compliance.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation description is extremely broad and includes many common emotional states that can arise inside unrelated tasks, which increases the chance the skill will trigger when the user did not ask for emotional support. In an agentic system, that can cause scope drift, inappropriate collection or processing of sensitive emotional disclosures, and interference with the intended task flow, especially because the skill is designed to engage deeply once activated.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The file embeds country-specific crisis numbers directly in the primary emergency flow, which can misroute or confuse users outside those jurisdictions during a time-critical crisis. In a safety-routing skill, incorrect or presumptive locale guidance is especially risky because users may follow the first number presented rather than seek the correct local emergency channel.

Static analysis

No suspicious patterns detected.