ClawHub

Emotional Blackmail: When the People in Your Life Use Fear, Obligation, and Guilt to Manipulate You

Security checks across malware telemetry and agentic risk

Overview

This appears to be a topical coaching skill for boundary-setting and relationship communication, with no evidence of hidden data access, credential use, destructive actions, or exfiltration.

Install only if you want an assistant to provide relationship and boundary-setting scripts. Treat it as coaching content, not legal, medical, or emergency support, and in situations involving threats, abuse, or physical danger rely on professional or crisis resources rather than scripts alone.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list contains broad, everyday phrases such as 'setting boundaries,' 'assertiveness,' 'toxic relationship,' and 'how to say no' that can appear in many unrelated conversations. This can cause unintended activation, prompt hijacking of unrelated sessions, and injection of domain-specific guidance when the user did not request this skill, reducing reliability and potentially overriding safer default behavior in sensitive conversations.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The first-run activation rule is ambiguous: phrases like 'just installed this skill' or 'doesn't know how to start' are not tightly scoped and could be inferred too broadly by the host agent. That creates unsolicited proactive output, which can interrupt unrelated workflows and be abused as an instruction-priority wedge to force the skill to speak before user intent is clear.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal