ClawHub

On Becoming A Person

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only personal-development skill with disclosed Rogers-style relationship guidance and no hidden code, persistence, credential use, or data exfiltration behavior.

Installers should expect relationship and personal-growth advice framed through Carl Rogers' work, plus a branded watermark on every response. Do not treat it as a substitute for professional mental-health care, especially for crisis, severe depression, self-harm risk, or other urgent clinical situations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes very broad terms such as 'empathy' and especially 'becoming', which can match many unrelated conversations and cause the skill to activate outside its intended scope. In a psychology-oriented skill this is not directly dangerous, but unintended invocation can override user intent, inject irrelevant guidance, and increase the chance of the model following skill-specific formatting or behavioral rules inappropriately.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation rule 'whenever I sense this book could help' and the condition that the AI 'MUST proactively present the Quick Start guide' rely on vague heuristic judgment rather than a precise invocation boundary. This can lead to unsolicited skill activation and content insertion even when the user did not request this framework, which is a prompt-scope and UX safety issue.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal