Security audit

Still Growing / 第二代父母

Security checks across malware telemetry and agentic risk

Overview

This parenting skill is not malicious, but it needs review because it handles child suicide-risk guidance without clear emergency escalation and includes overbroad local/session context searches.

Review carefully before installing. Treat this as reflective parenting support only, not emergency, clinical, or child-safety advice. If a child expresses suicidal thoughts or imminent danger, contact local emergency services or a crisis hotline immediately and seek qualified professional help. Also be aware that the skill may prompt agents to search local skills, session history, and git history unless those instructions are narrowed or disabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill instructs the agent to inspect git remote commit history even though the stated purpose is parenting support. That expands the agent's scope into unrelated repository reconnaissance, which can expose metadata, leak contextual information, and normalize unnecessary access beyond user need.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: Default instructions to search the entire local skills directory and session history are broader than necessary for a counseling-oriented skill. This creates unnecessary access to local and conversational context, increasing the chance of privacy exposure or over-collection of unrelated information.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill gives guidance for a child saying 'I don't want to live' without explicitly directing the parent to seek immediate professional, crisis, or emergency help. In a suicidality context, omission of escalation guidance can delay urgent intervention and create a serious safety risk.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger terms are broad, emotionally charged, and common in parenting or mental-health discussions, which can cause the skill to activate in conversations beyond its intended scope. In a sensitive domain involving family conflict, trauma, and child behavior, overbroad triggering increases the chance of unsolicited intervention or inappropriate framing of user issues.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.