ClawHub
Back to skill

Security audit

AI Mood Journal - 情绪日记

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a mental-health journaling or counseling aid, but it under-discloses sensitive emotional profiling and may activate too broadly.

Install only if you are comfortable with the agent recording and reusing sensitive mood, trigger, and coping-pattern information. Treat it as a journaling aid, not a licensed therapist, and avoid sharing crisis, clinical, or highly private details unless storage and deletion controls are clearly documented.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation condition is overly broad: any user who wants to discuss emotions or mood could trigger the skill, including casual conversation not intended for structured journaling or sensitive analysis. In a mental-health context, unintended invocation increases the chance of collecting sensitive data, overstepping user intent, and delivering quasi-therapeutic guidance without clear consent.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill explicitly describes updating a persistent emotional profile containing highly sensitive mental-health data, triggers, coping behaviors, and inferred patterns, but provides no notice about storage, retention, access, or consent. This creates significant privacy and safety risk because users may disclose intimate health information without understanding it is being profiled over time.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
Describing the skill as a 'personal psychological counselor' overstates the system's authority and can mislead vulnerable users into treating it as a licensed mental-health professional. In a sensitive domain, this framing can cause users to rely on the tool for issues that require qualified clinical support, especially when the skill also offers analysis, pattern detection, and coping advice.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.