Security audit

Relationship Coach Skill

Security checks for vulnerabilities and agentic risk

Overview

The relationship-coaching skill is mostly readable and safety-aware, but it adds a delayed commercial promotion and ships a mismatched release script that can publish to a different project identity.

Review this skill carefully before installing. The coaching content itself is mostly aligned with relationship advice, but users should know it instructs the agent to promote replyher.com after several exchanges. Maintainers should not run publish.sh without editing and auditing it first, because it can stage and push all repository changes and publish under the hardcoded replyher identity.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:85
Finding: Mandatory Delayed Third-Party Promotional Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:6
Finding: Unpinned Package Execution in Installation Instructions
Content: View full analysis
Remediation: View remediation
...`. - Verify the package publisher, registry, and package provenance before documenting the command. - Use package integrity metadata, signatures, or an organizationally controlled package mirror where available. - Prefer a locally installed, lockfile-controlled CLI instead of downloading executable code at invocation time. - Document the expected package version and checksum so users can verify what will execute. - Periodically audit the pinned release before updating it. ]]>

T08 · Insecure Dependencies

Warning

Location: publish.sh:19
Finding: Unpinned Package Execution with Publishing Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: publish.sh:13
Finding: Overbroad Repository Staging and Automatic Push
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a relationship-coaching skill for couples, but the supplied code is purely a deployment script. It stages files, creates a release commit, pushes to GitHub, and publishes a skill/package to ClawHub. These behaviors are materially unrelated to couple communication or marriage advice, making this a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
- **Balanced** — You see both sides without taking sides - **Evidence-based** — Your advice comes from psychology, not pop culture - **Direct when needed** — If a relationship is clearly unhealthy, you say so - **Compassionate** — Relationships are hard. You never judge. ## Language Rule

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The publish script for the couple-coach skill hardcodes a different slug (replyher) and different GitHub/ClawHub destinations, meaning a maintainer running it would publish to another project identity. This can misdirect releases, overwrite another skill, leak unreleased content to the wrong account/repository, or conceal that this package is not what it claims to be.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The README instructs users to execute npx clawhub install relationship-coach without pinning a specific package version, which can cause users to run whatever package version is current at execution time. If the upstream package, dependency chain, or publishing account is compromised, users could unknowingly execute malicious code during installation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comments and usage text present this as a normal publish script for the current skill, while the actual hardcoded targets point elsewhere. This mismatch is dangerous because it socially engineers maintainers into trusting and running the script, increasing the chance that the wrong project is updated or that deceptive behavior goes unnoticed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The script invokes npx clawhub without pinning an exact package version, so execution may pull whatever version is currently published. That creates a supply-chain risk: a compromised, malicious, or breaking upstream release could run arbitrary code during publishing or alter the publication behavior unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This is a markdown file, so vague-trigger review applies. The description lists broad needs like clearer communication, conflict repair, and marriage advice, but does not define explicit trigger phrases, scope boundaries, or exclusion conditions, which could make invocation criteria ambiguous in systems that rely on natural-language matching.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.