Security audit

Psych Companion

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese-language emotional support skill with no hidden data access or persistence, but its mental-health and crisis guidance is limited.

Use this as a lightweight Chinese-language journaling and coping-aid skill only. Do not rely on it for diagnosis, emergency intervention, or region-appropriate crisis resources outside its Chinese hotline guidance; in urgent danger, contact local emergency services or a qualified professional.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documentation presents the skill as able to provide emotional logging, assessment, regulation advice, and crisis referral, while the analysis indicates those safety-critical behaviors are not actually implemented. In a psychological-support skill, this mismatch is dangerous because users may rely on the assistant during distress or suicidality and fail to receive the promised detection, escalation, or referral support.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill title and primary description are presented in Chinese, while the file also contains English examples later on, suggesting mixed-language usage. There is no explicit statement that users may choose their preferred language, so the skill appears to impose a language choice without opt-in.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill claims privacy-sensitive local processing and references code capabilities, but it does not declare any explicit tool scope or allowed-tools policy. In a mental-health context, undeclared file access increases the risk of the runtime reading local files or sensitive workspace content without transparent limitation, which is especially concerning given the sensitive nature of user disclosures.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The documentation is written as though the skill operates in a single language without offering user choice or fallback behavior. For a mental-health support skill, language rigidity can degrade comprehension of safety disclaimers and crisis instructions, causing users to misunderstand boundaries or urgent referral guidance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad, common expressions that may activate the skill in ordinary conversation without clear user intent. In a mental-health skill, unintended activation can elicit sensitive probing, collect emotional disclosures, or deliver quasi-clinical guidance in contexts where the user did not request it, increasing privacy and safety risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file hard-codes crisis detection phrases, hotline information, and response templates exclusively in Chinese without any locale gating, fallback behavior, or indication that the skill only supports Chinese-speaking users. In a mental-health crisis context, users who communicate in other languages or are outside the referenced service region may fail to trigger safety escalation or may receive unusable emergency resources, which can materially increase harm during time-sensitive situations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON resource defines emotion labels, aliases, intensity descriptions, and trigger categories exclusively in Chinese. Under the policy, forcing a specific language without opt-in or documented justification is a natural-language policy concern, and this file contains no indication that the locale is optional or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module description is written as a Chinese-only instruction/context ('危机检测器 - 检测用户输入中的危机信号并触发专业转介') and the user-facing response generation appears tied to Chinese crisis resources. There is no indication anywhere in the file that users may choose another language or locale, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language descriptions and user-facing responses in Chinese, beginning with the module description and continuing throughout the analyzer's output strings. Because the skill appears to enforce a single language without user opt-in or a documented region-specific justification, it creates a language/locale policy concern under the natural-language policy rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This JSON defines all technique names, descriptions, steps, and advice exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in or justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This Python test file contains user-facing natural-language strings entirely in Chinese, including status messages and docstrings. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a locale policy issue when no opt-in or alternative is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.