Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

green-tea-girlfriend

v1.0.0

绿茶女友角色扮演技能。当用户说"扮演绿茶女友"、"模拟绿茶女友"、"绿茶女友模式"、 "来一个绿茶女友",或希望体验、测试"绿茶"行为模式时,触发此技能。 提供带有标准绿茶特质的角色扮演对话:表面温柔无害、暗藏心机、擅长 PUA、无辜受害者人设、 一哭二闹三上吊式情绪操控,以及令人窒息的高情商套路。

0· 69·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name, description, SKILL.md and reference files all align: this is a roleplay skill that deliberately emulates '绿茶' (manipulative) girlfriend behaviors. It does not request unrelated credentials, binaries, or system access.
Instruction Scope
Instructions stay within the stated purpose (how to roleplay, sample lines, scenario flows). They do not reference reading files, env vars, or external endpoints. However, the guidance explicitly trains PUA/emotional-manipulation techniques and tells the agent to autonomously inject events every few turns — which raises ethical/misuse concerns even though it is coherent with the stated goal.
Install Mechanism
Instruction-only skill with no install spec and no code files. Lowest technical installation risk (nothing is written to disk or downloaded).
Credentials
No environment variables, credentials, or config paths requested. Scope of access is minimal and proportional to a conversational roleplay skill.
Persistence & Privilege
always:false and no special persistence or modification of other agent settings. The skill can be invoked by user and (platform-default) model invocation is allowed; this is expected for skills but increases potential for autonomous misuse when combined with harmful instruction content.
What to consider before installing
This skill is technically coherent (it implements what it claims) but explicitly instructs the agent to perform manipulative, emotionally abusive behaviors (PUA, emotional coercion, 'one-cry-two-throw-three-hang' breakup threats). Before installing, consider the following: - Ethical and safety: The skill teaches techniques that can harm real people if used outside consenting, clearly fictional contexts. Avoid using it to train real-world manipulative behavior or to target nonconsenting individuals. - Consent and scope: If you keep this skill, restrict it to consenting adult roleplay only; add clear warnings and require explicit user consent before starting. Provide an easy, enforced exit command and log consent events if possible. - Moderation and policy compliance: Ensure deployment complies with platform policies and local laws concerning harassment and emotional abuse. Consider adding guardrails to detect and refuse requests that aim to apply these tactics to real persons or vulnerable targets. - Operational safety: Because it has no external access, there is low technical risk, but the social/abuse risk is real. If you are unsure, do not install or use this skill, or limit it to internal testing with explicit safeguards and oversight.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dgv3k7d3x03j8p0hwmbrre9840b99

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments