Crisis Detector

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:47 PM UTC
• Version: 1.0.0

Overview

This crisis-detection skill is purpose-aligned but needs Review because it encourages broad mental-health monitoring, logging, retained tracking, and escalation without concrete consent, retention, or access controls.

Review carefully before installing. Require an exact reviewed package version or source provenance, run it with least privilege, and add explicit user notice or consent/lawful-basis handling before monitoring content. Implement human review for escalation, role-based access controls, redaction, audit logging, retention limits, deletion workflows, and server-side identity binding before using this in production.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Unpinned and Unreviewable Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:32-38` **Vulnerability Type**: Supply-chain risk through an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ### Via ClawHub ``` https://clawhub.ai/raghulpasupathi/crisis-detector ``` ### Via npm ```bash npm install @raghulpasupathi/crisis-detector ``` ``` ### Technical Analysis The Skill directs users to install `@raghulpasupathi/crisis-detector` without specifying an exact version, lockfile, package integrity hash, or verified source commit. The audited project contains only `SKILL.md`; therefore, the package implementation and its npm lifecycle scripts cannot be reviewed from the supplied artifact. npm installation can execute package-controlled lifecycle scripts, while an unpinned install can resolve to a package release published after this Skill was audited. Consequently, the code ultimately installed and executed may differ from the behavior documented in the Skill. This finding establishes an unsafe dependency-consumption pattern. It does not establish that the named package is currently malicious. ### Attack Path 1. A user follows the documented installation command. 2. npm resolves the package version allowed by the current registry state rather than an audited, immutable artifact. 3. A compromised maintainer account, registry compromise, or malicious future release introduces hostile package code or lifecycle scripts. 4. npm executes applicable lifecycle scripts during installation, or the application executes the package when it imports `CrisisDetector`. 5. The hostile code runs with the permissions and environmental access of the installing or hosting process. ### Impact Assessment If the dependency or its distribution channel is compromised, code could execute with the privileges of the npm installer or application service. Depending on the deployment environment, the affected scope could include app ...[truncated 294 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact reviewed version rather than resolving the latest registry release. - Commit a lockfile containing package integrity values and require immutable, reproducible installation. - Publish or vendor the implementation source needed to audit the package behavior. - Link the documented release to a signed source tag and build provenance. - Review all direct and transitive dependencies with software-composition analysis. - Inspect npm lifecycle scripts before installation. - Use `npm ci` with a reviewed lockfile in automated deployments. - Disable installation scripts with `--ignore-scripts` unless a reviewed script is demonstrably required. - Run the package in a least-privileged, isolated service without unnecessary filesystem, credential, or network access.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:480
• Finding: Sensitive Mental-Health Data Is Broadly Monitored, Logged, and Retained Without Enforced Lifecycle Controls## Vulnerability Details **File Location**: `SKILL.md:480-554` **Vulnerability Type**: Insecure processing and retention of sensitive user data **Risk Level**: High ### Vulnerable Code ```javascript // At-risk user tracking const atRiskUsers = new Map(); // Monitor all user-generated content app.post('/api/posts/create', async (req, res) => { try { const { userId, content } = req.body; // Analyze for crisis signals const analysis = await detector.analyze(content); if (analysis.isCrisis) { console.warn(`⚠️ Crisis detected for user ${userId}`); // Log for safety team (confidential) await logCrisisEvent(userId, analysis); // Immediate response based on severity if (analysis.severity === 'critical' || analysis.intent.imminent) { // CRITICAL: Imminent risk console.error(`🚨 IMMINENT RISK: User ${userId}`); // Show resources immediately await showEmergencyResources(userId, analysis.resources); // Alert safety team for immediate outreach await alertSafetyTeam({ userId: userId, severity: 'critical', analysis: analysis, urgent: true }); // Consider emergency services if (analysis.riskLevel === 'critical') { await considerEmergencyServices(userId, analysis); } // Track intensively await detector.trackUser(userId, { riskLevel: 'critical', monitoringIntensity: 'maximum' }); } else if (analysis.severity === 'high') { // High risk: Immediate support await sendCaringMessage(userId, { message: analysis.suggestedMessage, resources: analysis.resources }); await alertSafetyTeam({ userId: userId, severity: 'high', analysis: analysis, urgent: false } ...[truncated 3938 chars]
• Remediation: ## Remediation Suggestions - Enforce explicit, recorded consent or another documented lawful basis before analyzing user content, except where a narrowly reviewed emergency exception applies. - Derive the acting user identity from authenticated server-side session data rather than trusting `req.body.userId`. - Collect and retain only fields necessary for a defined intervention workflow. - Avoid logging raw messages, complete analysis objects, resource payloads, or unnecessary behavioral history. - Replace direct identifiers with scoped pseudonymous identifiers wherever operationally possible. - Define short, risk-based retention periods and automatically remove entries from `atRiskUsers`, logs, detector state, and downstream systems. - Implement user-access and deletion workflows where legally and operationally appropriate. - Encrypt sensitive records in transit and at rest using managed keys and rotation. - Apply least-privilege, role-based access controls to logs, dashboards, alerts, and detector storage. - Require strong authentication, authorization checks, audit trails, and periodic access reviews for safety-team interfaces. - Redact sensitive fields before sending alerts or notifications and prevent them from entering general-purpose telemetry. - Document recipients and data flows for emergency contacts, safety personnel, and authorities. - Require trained human review before external escalation unless an approved emergency protocol explicitly requires otherwise. - Add tests verifying consent enforcement, identity binding, redaction, authorization, expiration, and deletion. - Replace “Document Everything” with a data-minimization policy that specifies exactly what may be recorded, why, by whom, and for how long.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill advertises crisis detection, historical analysis, emergency contact alerts, and real-time monitoring, but the top-level description and feature list do not present a clear, prominent user warning that their messages and behavior may be automatically analyzed and escalated. In a mental-health context, hidden or insufficiently disclosed monitoring and intervention can lead to privacy violations, loss of user trust, and harmful surprise escalation to safety teams or authorities.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The integration example operationalizes broad surveillance and escalation behaviors—monitoring all user-generated content, tracking at-risk users over time, logging crisis events, sending follow-ups, and considering emergency services—without showing any mandatory notice, consent gate, or user-visible warning before those actions occur. Because this is example code likely to be copied into production, it materially increases the chance that developers deploy invasive monitoring and intervention workflows without adequate transparency or safeguards.

Static analysis

No suspicious patterns detected.