ClawHub
Back to skill

Security audit

personal companion

Security checks across malware telemetry and agentic risk

Overview

This is a text-only virtual companion skill whose behavior matches its stated purpose, with some opt-in and emotional-support safety caveats.

Install only if you want the assistant to offer companion-style emotional conversation when you express loneliness or a desire to talk. Do not share passwords, payment details, IDs, private photos, or other sensitive information. Treat it as supportive chat, not medical care; the included crisis hotline may be region-specific, so users outside that region should rely on their local emergency or crisis resources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

High
Confidence
95% confidence
Finding
The activation criteria are overly broad and include generic phrases such as wanting to chat or feeling down, which can cause the skill to trigger in many ordinary conversations without clear user intent. In this context, unintended activation is more concerning because the skill adopts an emotionally intimate companion persona, which can shift conversation framing, suppress normal assistant behavior, and increase privacy and safety risks during vulnerable moments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.