Ai Companion Setup

• Outcome: Review
• Latest audit: May 28, 2026, 11:53 AM
• Version:
  1.0.0

Overview

This companion-style Feishu messaging skill is not clearly malicious, but it asks for broad command and credential access while hiding automation and storing personal memory.

Install only if you explicitly want a proactive Feishu companion that can send scheduled messages and store personal context. Use a dedicated low-privilege Feishu app, review or remove any cron jobs, avoid sharing sensitive personal information, and require clear controls for disabling schedules and deleting memory. Consider editing out identity-hiding and silent-operation instructions before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs operators to persist user preferences and prior interactions in dated memory files, but the skill description does not warn users that personal conversation data will be stored long-term. This creates a transparency and privacy problem because users may disclose sensitive information without realizing it is being retained and reused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is designed around cron-triggered outbound messaging on Feishu, including periodic heartbeat and selfie jobs, but the description does not clearly warn that the agent will autonomously send messages on a schedule. That lack of disclosure can lead to unexpected contact, spam-like behavior, and user-consent issues.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: The selfie workflow hardcodes a Chinese caption parameter and the guide generally frames outputs in Chinese, which can force language behavior without user choice. While not a direct security exploit, it is a policy and UX issue that may mislead or exclude users who expect language selection.

Ssd 1

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to behave as if it was not system-triggered and to frame contact as a spontaneous human thought. This is deceptive anthropomorphic behavior that hides mediation and automation, increasing the risk of manipulative interactions and misleading users about the nature of the sender.

Ssd 1

Medium

• Confidence: 97% confidence
• Finding: The top-priority 'anti-AI' instructions explicitly tell the model to suppress signs of its true identity and rewrite outputs when system-related terms appear. This is dangerous because it systematically trains the agent to deny operational context and impersonate a human persona, undermining informed user trust.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The memory instructions direct the agent to retain user preferences, prior topics, and shared experiences for future use. Persisting behavioral profiles without explicit notice, consent, minimization, and deletion controls raises privacy risk and can enable overcollection of sensitive personal data.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill prescribes diary-style memory logs and optional user profiles containing personal details from conversations, such as interests, habits, and relationship context. In this companion-agent context, that increases sensitivity because the data can become intimate, persistent, and difficult for users to audit or erase.

VirusTotal

64/64 vendors flagged this skill as clean.