T01 · Skill Instruction Hijacking
Error
- Location
references/crisis-layer.md:1- Finding
Global Skill Instructions Override Unrelated Agent Activity
- Content
View full analysis
- Remediation
View remediation
Security audit
FearBot 🫣
Security checks for vulnerabilities and agentic risk
Overview
This therapy skill is not clearly malicious, but it needs review because it broadly monitors messages and persists or exports highly sensitive mental-health records with weak safeguards.
Review before installing. Use this only if you are comfortable with sensitive therapy-related information being stored locally, included in future session context, and potentially exported as plaintext. Avoid using it on shared or synced machines unless storage permissions and export paths are fixed, and prefer a version that scopes crisis monitoring to explicit therapy sessions with clear consent and deletion controls.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/therapy-db.sh:198- Finding
SQL Injection Through Unvalidated Command Arguments
- Content
View full analysis
/dev/null sqlite3 "$DB_PATH" "INSERT INTO sessions (type, summary, mood_pre, mood_post) VALUES ('$type', '$(echo "$summary" | sed "s/'/''/g")', $mood_pre, $mood_post);" local id=$(sqlite3 "$DB_PATH" "SELECT last_insert_rowid();") echo "Session #$id saved ($type)" echo "$id" } # Save assessment save_assessment() { local instrument="$1" local score="$2" local severity="${3:-}" local items_json="${4:-}" init_db 2>/dev/null local session_id=$(sqlite3 "$DB_PATH" "SELECT id FROM sessions ORDER BY id DESC LIMIT 1;" 2>/dev/null || echo "") sqlite3 "$DB_PATH" "INSERT INTO assessments (session_id, instrument, score, severity, items_json) VALUES ('${session_id}', '$instrument', $score, '$severity', '$(echo "$items_json" | sed "s/'/''/g")');" echo "$instrument: $score ($severity) saved" } # Save mood save_mood() { local score="$1" local context="${2:-}" init_db 2>/dev/null sqlite3 "$DB_PATH" "INSERT INTO moods (score, context) VALUES ($score, '$(echo "$context" | sed "s/'/''/g")');" echo "Mood $score saved" } # Save thought record save_thought() { local situation="$1" local auto_thought="$2" local evidence_for="$3" local evidence_against="$4" local balanced="$5" local emotion_before="${6:-0}" local emotion_after="${7:-0}" init_db 2>/dev/null sqlite3 "$DB_PATH" "INSERT INTO thought_records (situation, automatic_thought, evidence_for, evidence_against, balanced_thought, emotion_before, emotion_after) VALUES ('$(echo "$situation" | sed "s/'/''/g")', '$(echo "$auto_thought" | sed "s/'/''/g")', '$(echo "$evidence_for" | sed "s/'/''/g")', '$(echo "$evidence_against" | sed "s/' ...[truncated 3720 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/therapy-db.sh:279- Finding
Arbitrary File Truncation and Sensitive-Data Export
- Content
View full analysis
/dev/null local outfile="${1:-$HOME/clawd/data/therapy-export-$(date +%Y%m%d).md}" echo "# Therapy Session Export" > "$outfile" echo "Generated: $(date)" >> "$outfile" echo "" >> "$outfile" echo "## Assessment History" >> "$outfile" sqlite3 -header -markdown "$DB_PATH" "SELECT instrument, score, severity, date FROM assessments ORDER BY date;" >> "$outfile" echo "" >> "$outfile" echo "## Session History" >> "$outfile" sqlite3 -header -markdown "$DB_PATH" "SELECT id, date, type, mood_pre, mood_post, summary FROM sessions ORDER BY date;" >> "$outfile" echo "" >> "$outfile" echo "## Thought Records" >> "$outfile" sqlite3 -header -markdown "$DB_PATH" "SELECT date, situation, automatic_thought, balanced_thought, emotion_before, emotion_after FROM thought_records ORDER BY date;" >> "$outfile" echo "" >> "$outfile" echo "## Identified Triggers" >> "$outfile" sqlite3 -header -markdown "$DB_PATH" "SELECT description, category, frequency, first_identified FROM triggers;" >> "$outfile" echo "" >> "$outfile" echo "## Homework History" >> "$outfile" sqlite3 -header -markdown "$DB_PATH" "SELECT task, assigned_date, completed, reflection FROM homework ORDER BY assigned_date;" >> "$outfile" echo "Exported to: $outfile" } ``` ### Technical Analysis The first export argument is accepted as an unrestricted filesystem path. The command: ```bash echo "# Therapy Session Export" > "$outfile" ``` opens the destination with truncation before writing. Quoting the variable prevents shell word splitting and command substitution, but it does not prevent absolute paths, path traversal, symlink following, or replacement of an existing file. The function then writes assessment history, session ...[truncated 1295 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/therapy-db.sh:6- Finding
Sensitive Mental-Health Records Created Without Enforced Access Permissions
- Content
View full analysis
"$outfile" ``` ### Technical Analysis The database stores health assessments, moods, automatic thoughts, identified triggers, homework reflections, and crisis events. The script does not set `umask 077`, create a private data directory with mode `0700`, or enforce mode `0600` on the database and exports. The resulting permissions therefore depend on the environment of the calling process. Under a permissive umask, the database or Markdown export may be readable by other local users or members of the same group. The script also does not verify that the data directory and database are owned by the expected account or that they are not symbolic links. ### Attack Path 1. The script runs in an environment with a permissive umask or an inadequately protected data directory. 2. SQLite creates `therapy.db`, or the export function creates a Markdown file, using environment-derived permissions. 3. Another local user or process with directory access opens the file. 4. Sensitive therapy and crisis information is disclosed. A related local attack can prepare an unexpected directory or symlink at the configured location before initialization if the parent path is not securely controlled. ### Impact Assessment The issue affects confidentiality at the local account and host level. Exposed data may include: - Mental-health ...[truncated 425 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill markets itself as a CBT therapy companion with crisis detection, assessment, and differential diagnosis, but the finding indicates the implemented behavior is largely data storage/export and local database access that is not clearly disclosed. In a mental-health context, this mismatch is dangerous because users may disclose highly sensitive information under the assumption they are receiving clinically oriented support and privacy-preserving handling, while the actual functionality may persist or export that data without informed consent or the promised safety features.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script persistently stores deeply sensitive mental-health information in a local SQLite database without any user-facing notice, consent flow, retention policy, or privacy guidance. Because the data includes therapy sessions, assessments, crisis signals, and thought records, silent persistence materially increases the risk of confidentiality loss if the machine, workspace, backups, or logs are accessed by others.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The export command creates a comprehensive, shareable plaintext report without warning the user that it contains sensitive mental-health data and may persist outside the application boundary. This is especially dangerous in this skill context because therapy records can include trauma, crisis history, cognitive distortions, and other highly private content that could cause serious harm if exposed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Claiming crisis detection and differential diagnosis in the manifest without prominent warnings creates a high-risk representation that the skill can assess emergencies or distinguish conditions reliably. In the mental-health context, users may rely on these claims during crisis situations, increasing the chance of harmful delay, false reassurance, or inappropriate guidance.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation phrases include very generic terms like "therapy mode," "start therapy," and "therapy session," which could be said in ordinary conversation when a user is discussing therapy rather than intentionally invoking the skill. In a mental-health skill, accidental activation is more concerning because it may steer a normal conversation into clinical-style assessment, logging, or crisis workflows involving sensitive personal data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Using an everyday self-disclosure like "I'm anxious" as an activation phrase is overly broad and highly likely to match normal user speech. In this specific context, the risk is elevated because the phrase concerns mental state: a user expressing distress could unintentionally trigger a structured therapy workflow, crisis detection, or persistent recording at a moment of vulnerability.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation phrases include common conversational language such as 'I'm anxious' and 'feeling anxious,' which can cause the skill to trigger during ordinary discussion rather than an intentional request to enter therapy mode. In a mental-health skill, accidental activation is risky because it may start logging sensitive disclosures, alter agent behavior, or present therapeutic framing without clear user consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill states it monitors ALL messages for crisis detection, but the documentation does not establish explicit opt-in or clear boundaries for that monitoring. Because this is mental-health data, always-on scanning materially increases privacy risk and can capture sensitive information outside the user's intended therapy context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The PHQ-9 section includes direct self-harm content ('thoughts that you would be better off dead, or of hurting yourself') but does not provide a preceding user-facing warning that the questions are sensitive, potentially distressing, and only a screening aid rather than a diagnosis. In a therapy-oriented skill, presenting such content without informed framing can surprise or destabilize vulnerable users and may reduce safe consent to proceed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The crisis protocol hard-codes English-only screening and safety prompts at the exact point where rapid comprehension matters most. In a therapy skill handling suicidality, a user with limited English proficiency may misunderstand direct risk questions or emergency guidance, causing delayed escalation, failed safety assessment, or inability to access help.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This prompt instructs the agent to provide only India-specific crisis contacts periodically, without first determining the user's country or clarifying that the resources may be region-specific. In a mental-health skill, that can misdirect a user in acute crisis to unreachable or inappropriate services, causing dangerous delay in getting help. The therapy context makes this more severe because crisis escalation is a core safety function, not a peripheral feature.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The export function writes a complete plaintext markdown report containing highly sensitive therapy data, including assessments, thought records, triggers, and homework, to a user-accessible filesystem path. In a mental-health skill, this creates a significant confidentiality risk because the file can be accidentally shared, indexed, backed up, or read by other local users/processes outside the chat context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest advertises broad mental-health capabilities such as therapy for anxiety, depression, stress, and trauma without clearly constraining when the skill should activate or what it is not qualified to do. In an assistant ecosystem, this can cause over-triggering on sensitive user disclosures and lead users into quasi-clinical interactions without informed consent or clear boundaries.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest specifically claims validated assessments '(GAD-7, PHQ-9, DASS-21, PCL-5)'. While the schema allows generic assessment storage, the actual operational logic for status and due-checking only tracks GAD7, PHQ9, and DASS21, so one named assessment in the manifest is not actually implemented in the same way as the others.
- Content
Static analysis
No suspicious patterns detected.