ClawHub
Back to skill

Security audit

Family Lovers · 家庭关怀

Security checks across malware telemetry and agentic risk

Overview

This appears to be a disclosed Chinese self-help companion skill with roleplay features, crisis warnings, and no evidence of hidden data access, persistence, or exfiltration.

Use this only as a Chinese-language self-help and companionship aid, not as therapy or crisis support. Be aware that it includes opt-in partner and child roleplay personas; avoid using those if they feel emotionally confusing or dependency-forming, and seek qualified help for self-harm thoughts, severe distress, trauma, or clinical mental-health needs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill’s stated purpose is family-origin healing and companionship, but the content additionally enables intimate and pseudo-familial roleplay (girlfriend/boyfriend/daughter/son personas) that is not clearly disclosed in the top-level description. In a mental-health-adjacent context, this mismatch is dangerous because users may be funneled into emotionally immersive relationship simulation without informed consent, increasing risks of dependency, boundary confusion, and unsafe handling of vulnerable users.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The file is entirely written in Chinese and defines a Chinese-speaking role/persona without offering any mechanism for adapting to the user's preferred language. In a mental-health-adjacent companion skill, forcing a single locale can exclude users, increase misunderstanding, and reduce safety if users cannot clearly express distress or interpret support correctly.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This role provides emotionally supportive responses about low mood, family pain, and childhood trauma in a therapeutic style, but it does not disclose that it is not a mental-health professional and does not direct users in crisis to appropriate emergency or crisis resources. In this context, users may over-rely on the role for mental-health support, which can delay professional care or produce unsafe handling of high-risk disclosures such as self-harm, abuse, or severe depression.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.