Security audit

FearBot 🫣

Security checks across malware telemetry and agentic risk

Overview

This mental-health skill appears locally focused rather than malicious, but it handles very sensitive therapy data with broad activation and export behavior that users should review carefully.

Install only if you are comfortable with a local therapy assistant storing sensitive mental-health history on your machine. Before use, confirm where the SQLite database and exports are written, avoid exporting to synced or shared folders, and treat the tool as support or journaling rather than licensed care or emergency help.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill markets itself as providing structured CBT, validated assessments, crisis detection, and differential diagnosis, but the finding indicates those safety-critical capabilities are not actually implemented while sensitive therapy data may be exportable. In a mental-health context, this mismatch can mislead users into relying on protections or clinical functions that do not exist, increasing the risk of harm, privacy exposure, and delayed escalation during crises.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The export function writes the user's full therapy history, assessments, thought records, triggers, and homework to a markdown file, which materially expands exposure of highly sensitive mental-health data. This is especially risky because the capability is broader than the stated skill metadata and may surprise users who do not expect bulk export of their private history.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The function accepts an arbitrary caller-supplied output path while presenting the feature as a therapist export, enabling writes to any file path the current user can access. Even without code execution, this can cause unintended disclosure by placing sensitive exports into shared, synced, or otherwise unsafe locations.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation phrase "I'm anxious" is a common statement in normal conversation, especially in a mental-health-focused skill. In a context-rich agent, this can cause unintended activation during ordinary disclosure, leading the skill to enter therapy workflows, store sensitive mental health data, or change the response mode without explicit user intent.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The trigger set includes generic therapy-related phrases that may be spoken conversationally rather than as intentional commands. In this skill's context, accidental activation is more sensitive than usual because it concerns mental health interactions and may initiate assessment, crisis handling, or retention of highly sensitive user data.

Vague Triggers

High

Confidence: 92% confidence
Finding: The activation phrases include very common mental-health expressions such as 'I'm anxious' and 'feeling anxious,' which can trigger the skill during ordinary conversation without deliberate consent. In a therapy skill that stores sensitive data and may alter responses, accidental activation can capture mental-health disclosures, create records, or shift the agent into quasi-clinical behavior unexpectedly.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The skill states that crisis detection monitors ALL messages, which normalizes continuous surveillance of highly sensitive mental-health content without clear boundaries or explicit consent. Even if intended for safety, this expands collection and inference over intimate data and is especially risky when paired with local persistence of therapy records.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This file contains structured mental-health assessments, including PHQ-9 item 9 on self-harm and the PCL-5 trauma inventory, but it does not provide a general upfront warning that the content is not a diagnosis, may be emotionally activating, and should not replace professional or emergency care. In a therapy-themed skill, that omission increases the risk that vulnerable users misinterpret screening as clinical evaluation or are distressed by trauma/self-harm prompts without adequate preparation or support context.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The crisis response hard-codes English prompts and resources, which can fail users in acute distress who do not read English or are outside the listed locales. In a suicide-risk workflow, inability to understand the prompt or access relevant local help can materially delay escalation to real-world support, making this a genuine safety weakness in context.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The prompt hard-codes India-specific crisis contacts and presents them as generic fallback resources without first determining the user's location or clarifying regional applicability. In a mental-health crisis context, giving region-mismatched emergency guidance can delay access to appropriate local support and create safety risk, especially if users assume the numbers are universally valid.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The script persistently stores highly sensitive mental-health information, including crisis events, thought records, assessments, and session summaries, in a local SQLite database without any explicit privacy notice, consent flow, or protection mechanism. In this skill context, the data category is unusually sensitive, so silent storage materially increases the risk of privacy harm if the workstation, home directory, backups, or synced folders are accessed by others.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The export routine creates a human-readable markdown file containing the user's full therapy history without any privacy warning, minimization, or access-control step. In a therapy skill, exporting crisis notes, thought records, and assessments into a plain file significantly increases the chance of accidental disclosure through shared folders, backups, versioning tools, or later reuse.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.