Love Companion - AI恋人陪伴技能包

• Outcome: Review
• Latest audit: May 29, 2026 at 9:38 PM UTC
• Version:
  1.0.1

Overview

This companion roleplay skill is mostly coherent, but it can automatically store intimate memories and has overbroad local file handling that users should review before installing.

Install only if you are comfortable with a local AI companion storing intimate preferences, emotional states, dates, and relationship-style history. Use a dedicated storage directory, avoid untrusted imports, avoid path-like scheme names, regularly review and clear memories, and do not rely on it for mental-health support.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The file explicitly warns that the skill is not a substitute for professional psychological counseling, yet one preset describes the persona as a '心理咨询师，擅长倾听和理解他人'. In an intimate companion context, that framing can cause users to over-trust the agent for emotional or mental-health support, weakening the disclaimer and increasing the chance of inappropriate quasi-therapeutic reliance.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation description is extremely broad, covering generic topics like relationships, roleplay, and emotional conversation. That can cause the skill to activate during ordinary sensitive chats and begin steering behavior or collecting intimate data when the user did not intentionally invoke it.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The statement that the skill will 'automatically recognize lover mode' from direct conversation is ambiguous and removes a clear activation boundary. In a companion skill handling emotional and potentially intimate content, ambiguous activation increases the risk of non-consensual persona switching, hidden memory collection, and unintended processing of sensitive personal data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that it automatically captures and stores highly sensitive information, including emotional patterns, trigger points, preferences, and relationship milestones, but the user-facing warning is not prominent or specific enough. In the context of an intimate companion skill, silent or under-disclosed retention of emotional data materially increases privacy and safety risk if data is mishandled, exposed, or retained longer than expected.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly supports storing, viewing, deleting, and clearing long-term memory entries that may include sensitive personal data such as birthdays, emotional state, and relationship preferences, but it does not clearly disclose retention scope, storage duration, access boundaries, or privacy risks. In a romantic-companion context, users are especially likely to provide intimate or mental-health-adjacent information, which increases the likelihood of collecting sensitive data without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The import/export commands allow profile configuration data to be serialized and transferred as JSON, but the documentation does not warn that these files may contain intimate personal preferences, names, relational settings, and potentially sensitive embedded content. In this skill's companion/roleplay setting, exported configurations are more likely to reveal private behavioral and emotional details, so sharing or importing them without warnings can expose users to privacy and data-handling risks.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The skill encourages saving '私人预设' for an intimate relationship companion without warning users that these presets may contain sensitive emotional preferences, nicknames, boundaries, or other personal data stored persistently. If retained insecurely or unexpectedly, this can expose highly sensitive relationship-style profile data and create privacy and consent risks.

VirusTotal

63/63 vendors flagged this skill as clean.