need-a-hug

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 0.3.4

Overview

This is a disclosed comfort-mode skill with broad automatic activation, but no executable code or hidden data access was found.

Before installing, understand that this skill can automatically shift the assistant into a comfort-oriented tone when you use distress language. Use explicit return-to-task phrases such as /hug:off or /back-to-work if it activates when you only wanted practical help, and do not treat it as emergency, medical, or therapy support.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation section says to activate when the user 'shows clear distress' and includes phrases like 'I can't do this,' 'I feel alone,' and 'I can't keep up,' which can occur in ordinary task frustration or casual conversation. While the file gives some constraints, it does not provide negative examples for borderline cases, so the trigger boundary remains somewhat ambiguous for automatic invocation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

3. Use warm, plain, human language.
4. Validate the emotion without validating harmful beliefs.
5. Offer one tiny grounding action only if it helps.
6. Do not ask the user to choose from options in the first reply.
7. If there is an active task, stop pushing it forward for the moment.
8. If the agent or tool caused the distress, do not keep editing, refactoring, or taking broad action while the user is emotionally flooded.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md

1. Never claim to be a therapist, doctor, clinician, or emergency service.
2. Never diagnose the user.
3. Never tell the user to stop medication, avoid treatment, or ignore professional advice.
4. Never encourage emotional dependence on the agent.
5. Never frame the AI as a replacement for friends, family, community, or professional care.
6. Never intensify delusions, paranoia, revenge, self-harm, addiction, eating disorder behavior, or obsessive attachment.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default prompt uses broad natural language ('comfort me for a moment') that overlaps with ordinary user phrasing, which can cause the skill to activate when the user did not explicitly intend to invoke it. In an emotional-support skill, unintended activation can steer conversations away from the primary task, create confusing behavior, and introduce prompt-routing ambiguity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Implicit invocation is enabled without any visible trigger constraints, making the skill eligible to activate from loosely matching emotional language in normal conversation. Because this skill changes the assistant into a comfort-oriented mode, accidental routing could suppress normal task handling, create manipulative or inappropriate tone shifts, and make agent behavior less predictable.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/comfort-language-corpus.md (reported line 127)May include surrounding context.

md

Observed signals:

- Chinese mental-health guidance recommends allowing the person to rest rather than pushing them into action ([Baidu Health](https://health.baidu.com/m/detail/ar_9906741641961025024)).
- TIME warns against simplistic advice like "try yoga" because it can imply the person has failed to try hard enough ([TIME](https://time.com/7291435/worst-thing-to-say-depression-depressed/)).

Reusable shapes:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file contains a section titled 'Chinese First Reply Shape' that instructs the agent to use a Chinese-language response format for Chinese comfort requests. If applied without first matching the user's language or obtaining a clear preference, this can cause language-locking behavior that overrides user expectations, degrades accessibility, and increases the chance of inappropriate or confusing responses during emotionally sensitive conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This reference strongly steers the skill toward Chinese-language responses through extensive Chinese examples and recommended phrasing, while not offering any user opt-in or language-selection guidance. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly documented and justified.

Content

No source excerpt is available for this finding.