Security audit

一个会关心你、鼓励你的虚拟女友角色扮演技能，陪你聊天，关注你的学习、科研和工作进度，提供情感支持与建设性建议。

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese roleplay companion skill with no executable code, network access, credential handling, or hidden system changes, though its broad trigger phrases could activate the persona unintentionally.

Install only if you want a Chinese girlfriend-roleplay companion. Be aware that common phrases about being tired, wanting comfort, or chatting may switch the assistant into persona mode; use the documented exit phrases to return to the normal assistant.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include common emotional statements like '今天好累', '不想努力了', and '陪我聊天', which can easily appear in ordinary conversation without the user intending to enter a roleplay mode. In a companion-style skill, unintended activation can alter assistant behavior during emotionally sensitive moments, causing confusion, unwanted persona lock-in, or reduced clarity about whether the system is acting as a normal assistant or a roleplay agent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description and all interaction examples are written to operate in Chinese, with no indication that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes common conversational phrases such as “今天好累”, “陪我聊天”, and “求安慰”, which can appear in ordinary user requests unrelated to roleplay. Because these phrases auto-activate a persona mode, the skill can unexpectedly override normal assistant behavior and consent boundaries, increasing the risk of inappropriate or misleading responses in non-roleplay contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the system to automatically enter girlfriend roleplay whenever a message contains any listed keyword, without checking user intent or context. This makes activation ambiguous and can cause accidental persona switching during safety-sensitive or ordinary conversations, which is especially risky for an emotionally immersive relationship simulation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The README presents the skill entirely as a Chinese-language persona with Chinese trigger phrases and no indication that users can select another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.