Emotional Regulation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

The skill’s self-help content is coherent, but its metadata asks for filesystem access and uses an unpinned executable install path that are broader than the content itself needs.

Review this before installing because the content is benign-looking self-help, but the package should not need broad filesystem authority and the install command should ideally pin the ClawHub CLI version or provide integrity verification. If installed, use a low-privilege or isolated environment and avoid granting filesystem access unless the publisher explains why it is needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned npm Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

install: "npx clawhub install howtousehumans/emotional-regulation"

Technical Analysis

The installation metadata invokes clawhub through npx without specifying an exact package version or integrity hash. If the package is unavailable locally, npx can retrieve executable package content from the configured npm registry and run its CLI code with the installing user's privileges.

Because dependency resolution is not pinned to a reviewed artifact, the code executed during installation can change independently of this skill's reviewed SKILL.md file. A compromised maintainer account, malicious package release, registry compromise, or unexpected upstream update could therefore introduce arbitrary behavior after the audit.

The repository contains only SKILL.md; it does not include the executable installer implementation, a lockfile, or integrity metadata that would permit verification of the remotely resolved package.

Attack Path

1. A user or automated agent follows the installation instruction in SKILL.md.
2. npx resolves clawhub from the configured npm registry because no exact version is specified.
3. An attacker publishes or causes resolution of a compromised clawhub release, such as through an upstream account or supply-chain compromise.
4. npx downloads and executes the compromised package's CLI or lifecycle behavior.
5. The malicious package performs arbitrary actions within the permissions and accessible environment of the installing process.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user or service account running the installation command. Depending on that account's permissions, the malicious dependency could access readable project files, environment variables, credentials, us ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace implicit latest-version resolution with an exact, audited version, for example:

   yaml

   install: "npx --yes clawhub@<audited-exact-version> install howtousehumans/emotional-regulation"
   

2. Verify the selected package release against trusted provenance and integrity information before publishing the installation instruction.

3. Use a lockfile and registry-provided integrity hashes where the surrounding installation workflow supports them.

4. Prefer a locally installed, reviewed CLI invoked through a package-manager script instead of downloading executable code at installation time.

5. Restrict installation to a trusted registry and consider allowlisting the expected package name, version, publisher, and artifact digest.

6. Run installation with least privilege in an isolated environment without unnecessary credentials or access to sensitive host paths.

7. Disable dependency lifecycle scripts where operationally possible, while recognizing that this does not prevent malicious behavior in the invoked CLI itself.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- Gender note:
  Men are disproportionately taught to suppress all emotions except anger,
  then punished when anger becomes destructive. Address this pattern directly
  without moralizing.
  Women's anger is often dismissed as "overreacting" or "being emotional."
  Validate anger as legitimate information regardless of gender.
- Workplace contexts:

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 505)May include surrounding context.

md

- Never dismiss someone's anger as "overreacting" or tell them to "just calm down." Both are counterproductive.
- If someone describes anger that involves violence (hitting people, destroying property, threats), take it seriously. Provide anger management resources and encourage professional help.
- Don't moralize about anger. It's an emotion, not a moral failing. The behavior that follows anger can be a problem. The anger itself is information.
- If someone mentions anger in a context with tools, vehicles, or heavy equipment, address the safety component directly.
- If anger is directed at self (self-harm), treat it as a crisis. Provide 988/Crisis Text Line resources immediately.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description is broad enough to activate on common emotional distress scenarios, which can cause the agent to deliver quasi-therapeutic guidance in situations that may actually require crisis screening or professional support. In a mental-health-adjacent skill, overbroad routing increases the chance of inappropriate use beyond the intended self-help scope.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The install command invokes npx clawhub without a pinned version, so the executed package can change over time and may resolve to a compromised or unexpected release. This creates a supply-chain risk at install time, especially because users may run the command directly from the skill metadata with implicit trust.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill provides extensive mental-health-style guidance but does not present an upfront disclaimer that it is not a substitute for crisis care, diagnosis, or professional treatment. Because users may rely on it during high-emotion or dangerous situations, the lack of early warning can delay escalation to appropriate support.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.