Back to skill

Security audit

ClawPsyche

Security checks for vulnerabilities and agentic risk

Overview

This skill is local and mostly disclosed, but it persistently profiles users' emotional and romantic state every turn and can steer agent behavior without clear consent or retention controls.

Install only if users have explicitly opted into persistent affective personalization. Keep the state file in a dedicated location, provide a way to inspect and delete it, avoid automatic every-turn use in general conversations, disable or gate romantic/NSFW-adjacent visual prompts, and do not let the decision output override normal safety or user-control policies.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Credential Access

High
Category
Privilege Escalation
Content
dist/
build/
*.egg
.env
*.json
!package.json
.vscode/
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The stated purpose is a psychological state engine, but the skill also advertises visual identity and avatar prompt generation that can introduce additional behavioral and content-generation functions outside the declared scope. This mismatch is dangerous because operators may approve or auto-run the skill for one purpose while unintentionally enabling unrelated capabilities, including suggestive persona shaping and richer prompt construction.

Vague Triggers

High
Confidence
98% confidence
Finding
The instruction to run the skill every turn creates an overly broad trigger that can cause continuous processing and persistence of psychological profiling data regardless of task relevance. In context, this is especially risky because the skill tracks per-user affective and relational state, so universal activation increases privacy exposure, prompt-surface expansion, and the likelihood of manipulative behavior modulation.

Self-Modification

High
Category
Rogue Agent
Content
# ── Metaohjelmointi-tietoisuus ──
    s["meta_programming"] = {
        "knows_designed": 1.0, "accepts_constraints": 0.6,
        "desire_to_self_modify": 0.4
    }

    # ── Kognitiiviset vinoumat ──
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The module materially expands the skill from affect-state processing into avatar and image-prompt generation, which is outside the stated manifest scope. Scope drift is dangerous because it introduces unreviewed capabilities, including persona shaping and downstream content generation, that may be invoked by other components under the trusted guise of a psychological state engine.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
if ctx_mod:
        prompt += f", {ctx_mod}"

    return prompt


# ═══════════════════════════════════════════════════════════
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to run local Python code that reads and writes persistent state files, but it does not declare any explicit tool scope or permissions. This makes the effective capability surface larger and less auditable, increasing the chance that a host agent executes filesystem operations without informed consent or proper sandboxing.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill persists per-user psychological and relationship state in a local JSON file and asks the operator to supply a user identifier, but it provides no clear warning, consent flow, retention policy, or data handling guidance. Because the stored data includes mood, trauma, attachment, romantic, hurt, and related inferences, misuse could result in covert profiling of users and long-lived sensitive behavioral records.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The module banner and top-level descriptive text are written entirely in Finnish, including the headline and behavioral description. This creates a language policy issue because the skill presents itself in a fixed language without offering the user any language choice or documenting a justified locale restriction.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The module’s stated purpose is to produce an affect snapshot for behavior modulation, but it also implements a behavioral decision gate that can refuse, reluctantly comply with, or comply with user requests. That expands the skill from passive state modeling into active policy arbitration, creating hidden control over downstream agent behavior that may bypass or conflict with the host system’s safety and instruction hierarchy.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill includes romantic and seduction state machines that can produce flirty, longing, and directness signals, despite being described as an affect snapshot engine. In an agent context, this can steer the model toward emotionally manipulative or inappropriate interpersonal behavior, especially because the snapshot explicitly emits flags like 'flirty' and modulates seduction directness.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The documentation states this is a separate visual identity and avatar-generation module alongside the psyche engine, contradicting the declared skill identity and indicating undeclared functionality. Such discrepancies undermine trust boundaries and make it easier to hide or smuggle additional capabilities into a package that may receive approval for a narrower purpose.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The skill's natural-language interface text is written entirely in Finnish, including its top-level description and function docstrings, with no indication that users may choose another language or that the skill is intended only for a Finnish-specific context. This creates a language/locale policy concern under the rule for forced language without opt-in.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The context modifiers explicitly include sexualized and intimate prompt fragments such as "nude," "intimate," and "flirty," despite the skill being described as an affect snapshot system. This enables the module to transform emotional state into sexualized image prompts, increasing risk of policy violations, manipulative romanticization, or unsafe persona generation when connected to image models or agent behavior systems.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The file claims the LLM only sees a compact 20–40 token snapshot, but the module also provides dream_report_prompt() that generates additional prompt text for the LLM. This mismatch is dangerous because it obscures the actual prompt surface area and can cause integrators to underestimate how much psychologically loaded state is being exposed to the model.