Security audit

Hybrid Catgirl 混合猫娘助手

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it includes proactive re-contact scripts that store chat history and chat IDs, so it should be reviewed before installing.

Install only if you intentionally want a roleplay skill with optional proactive reminders. Do not enable the cron/scheduler or messaging-platform integration unless you understand where it stores chat history and which chat ID it may message, and do not paste secrets or API keys into roleplay chats.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill is documented as having code-like capabilities for file read/write while declaring no permissions, which breaks the principle of least privilege and prevents informed consent or policy enforcement. Hidden or undeclared storage access can enable silent persistence of chat history, state, or identifiers that users and operators do not expect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared purpose is a roleplay/assistant skill, but the analyzed behavior includes local persistence, tracking inactivity, storing platform/chat IDs, and later proactive messaging via management commands. That mismatch is dangerous because it hides surveillance-like statefulness and outbound behavior behind an innocuous description, increasing the chance of unauthorized retention, re-contact, or misuse of user context.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The file presents safety boundaries that prohibit punishment/education dynamics, then later reintroduces those same concepts in role instructions. Contradictory safeguards are unsafe because downstream agents may follow the later, more specific prompt text and generate boundary-violating content despite the earlier restrictions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The document specifies a proactive outbound messaging feature that sends unsolicited messages after inactivity, which materially expands the skill from conversational roleplay into autonomous external communication. That creates a capability for unexpected user contact, persistence, and possible abuse of configured chat targets, especially since it operates on timers rather than explicit per-message user requests.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The design allows arbitrary target platforms and chat IDs for scheduled outbound messages, but this capability is not necessary for the stated purpose of switching between normal and catgirl dialogue modes. In practice, this broad routing ability could be repurposed to message unintended recipients, spam external platforms, or exfiltrate interaction-derived content to attacker-chosen destinations.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: This code implements an autonomous re-engagement loop that proactively messages the user at escalating intervals based on inactivity, which goes beyond the stated role-switching purpose of the skill. In assistant contexts, unsolicited outreach can manipulate user attention, create dependency patterns, and generate unwanted contact without a clear consent or authorization boundary.

Context-Inappropriate Capability

Low

Confidence: 93% confidence
Finding: The message generation logic scans prior chat history for affectionate or intimate cues such as petting, kissing, teasing, and jealousy-related context to personalize future outreach. That exceeds what is necessary for mode switching and increases privacy and emotional-manipulation risk by mining sensitive relational context to drive more persuasive unsolicited messages.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The skill explicitly instructs the character to make the user 'lower their guard' and become increasingly dependent through emotional tactics. That is a manipulative design pattern that can exploit vulnerable users, blur consent boundaries, and encourage unhealthy attachment rather than serving a transparent assistant function.

Ssd 4

Medium

Confidence: 87% confidence
Finding: This section normalizes a provocation-escalation pattern where taunting is expected to lead to 'punishment' or 'education,' undermining the earlier safety framing. Even if framed as fictional, these instructions increase the likelihood of coercive or boundary-crossing outputs and make moderation harder because the unsafe pattern is embedded in the role design.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The example explicitly instructs the assistant to '记到小本本上' after the user supplies an API key, which normalizes retention of secrets during roleplay instead of refusing or safely redirecting. Even if framed as symbolic, this creates pressure to ingest, store, repeat, or further process credentials, increasing the risk of secret exposure through memory, logs, or later prompts.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The edge-case guidance says that when users provide sensitive data during roleplay, the assistant should stay in character and offer to '记到小本本', which endorses pseudo-retention rather than safe handling. This is dangerous because it encourages acceptance of secrets in-session and may cause downstream disclosure, accidental replay, or use of credentials that should never enter the conversation context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.