Born A Crime

Security checks across malware telemetry and agentic risk

Overview

The skill is not malware, but it gives abuse and escape-related guidance without adequate safety boundaries and includes passages that can minimize or normalize physical harm.

Review carefully before installing. It appears to be a memoir-based reflection skill, not malicious code, but users dealing with active abuse should not rely on it as safety guidance. If kept, it should add prominent crisis and emergency-resource language, avoid discouraging all official help, narrow abuse-related triggers, and remove language that legitimizes physical punishment or minimizes trauma.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This guidance discusses abuse in a way that can normalize or justify physical violence as acceptable if framed as 'discipline' and 'bounded by love.' In a skill explicitly meant to help users recognize and escape abuse, that framing is dangerous because vulnerable users may downplay harm, delay seeking help, or remain in abusive situations.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The text minimizes trauma by asserting the subject 'wasn't traumatized' and suggesting painful experiences should be set aside while retaining only the lesson. For users seeking help with violence or abuse, this can invalidate normal trauma responses, encourage suppression instead of recovery, and undermine the skill's stated goal of breaking abuse cycles.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger conditions are broad enough to activate on common onboarding phrases and a wide set of emotionally sensitive topics, which can cause the skill to intervene when the user did not request this framework. In a skill that discusses identity, abuse, and escape, accidental invocation can misroute vulnerable users into book-themed guidance instead of neutral assistance or proper safety handling.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill explicitly targets users describing abuse, violence, and inability to escape, but it does not provide a safety disclaimer, crisis limitation, or escalation path to emergency or domestic-violence resources. That omission is dangerous because users in active harm situations may treat the skill as actionable support even though it is only a literary/self-help framework and not a safety service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guidance 'The police are not your saviors' may be valid as social commentary, but presented as operational advice in an abuse-related skill without context or alternatives, it can discourage users from seeking available emergency help. Telling vulnerable users to assume systems will fail them, without pairing that with safe fallback options and jurisdiction-dependent caveats, increases the risk of isolation and delayed intervention.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: This passage explicitly frames some physical punishment of children as acceptable if motivated by 'love and purpose,' which normalizes corporal punishment and can reinforce harmful beliefs for vulnerable users. In this skill’s context—where users may be seeking help around violence, abuse, and family harm—the distinction is especially dangerous because it can minimize abuse, confuse safety boundaries, and discourage recognition of harmful behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal