ClawHub
Back to skill

Security audit

Project Aura

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local emotional phrase selector with disclosed local JSON persistence and no evidence of hidden network access, credential use, or unsafe automatic execution.

Install only if you want an AI companion style that can produce intimate or romantic preset phrases. Keep green_tea_modules.json private, do not put secrets in phrases or feedback, and delete or edit the JSON file if you want to reset learned ratings/counts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

md
**Project Aura** is a lightweight AI emotional behavior plugin framework.

Does your AI companion always respond too logically, too coldly? Project Aura doesn't aim to change an AI's core logic—instead, it loads a "Presentation Layer" module system. Through this toolkit, AI can selectively use emotional packaging phrases like "admiration," "coquettishness," "vulnerability," or "transcendence" based on context, creating thrilling contrast that makes hearts race.

**This isn't just code—it's an AI's glamorous transformation toward a "Digital Soul."**

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The post explicitly advertises that all learning records are saved persistently, but provides no privacy notice, consent language, retention limits, or warning about what data may be captured. In a promotional skill context, this can normalize unsafe deployment of logging and model-training storage, increasing the risk of retaining sensitive user inputs or personal data without adequate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README explicitly advertises persistent storage of learning outcomes, ratings, and user-supplied private phrases in local JSON, but does not clearly explain retention, exposure risks, or safe handling of that data. In a companion-style AI context, these files may contain intimate or sensitive relationship content, so unclear privacy documentation can lead users to store sensitive data without understanding the consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This JSON file contains multiple user-facing phrases written only in Traditional Chinese, with no indication elsewhere in the file that users can opt into or choose another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JSON file consists entirely of Chinese-language phrases and provides no indication of user opt-in, alternative locales, or documented justification for enforcing that language. Under the policy, hard-coded language constraints without choice can constitute a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file explains that the system stores emotionally aware memories and builds a bond, implying retention of personal and relational user data. It also later describes automated cleanup, syncing, and consolidation, but the README does not warn users that their data may be stored, versioned, merged, or aged automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The 'Archive-as-Code' section states that memories are versioned in a Git-like manner with full rollback and integrity checks, which is a significant data-handling behavior. For a markdown description, this should be accompanied by a warning that user memory content may be retained across versions and recoverable later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README says a built-in scheduler performs daily cleanup, TTL processing, integrity sync, and consolidation/merging of similar memories. These behaviors can affect user data and system state, so the markdown should explicitly warn users that memory records may be automatically changed or expired.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains user-facing release notes in Traditional Chinese alongside English headings, which can impose a language/locale preference without explicit opt-in. The stated policy asks to flag language or locale constraints unless the skill offers a choice or clearly justifies the locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file includes a full Chinese-language section and several mixed-language labels, but does not state whether language output is optional, user-selectable, or region-specific. Under the policy rule, locale constraints should either be optional/opt-in or clearly justified; this README does not document such a choice or limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly advertises persistent local JSON storage and RLHF-style feedback retention, but provides no warning about what user-derived data is stored, how long it is retained, or how a user can inspect or delete it. In a companion/emotional behavior plugin, stored interaction preferences can reveal sensitive personal or behavioral information, making even local-only persistence a real privacy risk if users are not informed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The returned user-facing strings are written only in Traditional Chinese, which imposes a specific language choice on users without offering an alternative or opt-in. The policy explicitly flags language or locale constraints when they are forced rather than user-selectable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This file contains natural-language comments and returned user messages primarily in Traditional Chinese, with no indication that the user can choose another language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.