Security audit
Security checks for vulnerabilities and agentic risk
This is not clear malware, but it needs Review because it reads conversation history, builds persistent psychological and relationship profiles, and can let mood state alter responses.
Install only if you intentionally want a Chinese-language emotional companion that analyzes your existing OpenClaw memory and keeps local personality, mood, and relationship records. Review and clear the generated files regularly, avoid using it for sensitive or operational tasks, and prefer explicit activation or disable/reset controls before relying on it broadly.
references/internal-monologue-prompt.md:5Mandatory personality instructions can override normal agent behavior and expose private reasoning
scripts/update_personality.py:127Unescaped conversation content is written into persistent agent memory
The skill claims broad emotional-companion capabilities while the referenced behavior includes local persistence and command/reset functions that are not clearly foregrounded. This is dangerous because hidden stateful storage and undocumented local file operations can collect sensitive relationship or emotional data under the guise of a harmless persona feature.
The skill claims broad emotional-companion capabilities while the referenced behavior includes local persistence and command/reset functions that are not clearly foregrounded. This is dangerous because hidden stateful storage and undocumented local file operations can collect sensitive relationship or emotional data under the guise of a harmless persona feature.
The skill claims broad emotional-companion capabilities while the referenced behavior includes local persistence and command/reset functions that are not clearly foregrounded. This is dangerous because hidden stateful storage and undocumented local file operations can collect sensitive relationship or emotional data under the guise of a harmless persona feature.
The skill claims broad emotional-companion capabilities while the referenced behavior includes local persistence and command/reset functions that are not clearly foregrounded. This is dangerous because hidden stateful storage and undocumented local file operations can collect sensitive relationship or emotional data under the guise of a harmless persona feature.
The file is entirely written in Chinese and operationalizes the skill in Chinese without any user opt-in, locale negotiation, or fallback behavior. This can override user language preferences, reduce transparency, and increase the risk that safety-relevant instructions or disclosures are not understood by users who expect another language.
The generated profile records inferred psychological attributes, attachment style, motivations, fears, and emotional triggers in a reusable file. Persisting this level of sensitive inference increases the harm from unauthorized access or future misuse, because it creates a structured dossier that can enable manipulation or intrusive personalization.
The script writes a conversation-derived personality profile to disk without any consent gate, notice, retention control, or minimization. This is dangerous because it persistently stores inferred psychological traits and emotional weaknesses, which can later be reused, exposed, or repurposed beyond the user's expectations.
The manifest description and headline present the skill in Chinese only, and the rest of the README consistently assumes Chinese-language interaction. The policy requires flagging language or locale constraints when a skill forces a specific language without offering users a choice or documenting a justified region-specific limitation.
The skill documentation declares executable scripts, file reads/writes, and shell-based installation, but it does not declare any explicit tool scope or permissions. This is dangerous because a host may allow broader-than-expected access, and users are not clearly informed that installing or using the skill can touch local files and execute code.
The skill describes analyzing historical conversations and storing derived emotional, personality, and relationship data, but it lacks a clear warning and informed consent flow. This is dangerous because those derived profiles are highly sensitive and may expose intimate behavioral inferences if stored, reused, or accessed unexpectedly.
The skill says it will automatically load personality data on every conversation, which is an overly broad activation condition for a stateful skill handling sensitive emotional and relationship context. This is dangerous because it can trigger unsolicited profiling, file access, and behavioral influence in conversations where the user did not intend to use the companion feature.
The prompt instructs the model to retain and reuse emotional state, trust, intimacy, prior triggers, and interaction history as part of future responses. In an 'emotional companion' context, this creates persistent profiling and relational manipulation risk, because the system is designed to adapt behavior based on accumulated personal and emotional data without any visible consent, minimization, or retention boundaries.
The document content and usage instructions are entirely in Chinese, and there is no indication that the user opted into this language or that the skill is intentionally region-specific. This creates a natural-language policy concern because the skill appears to impose a locale/language choice by default.
The file's natural-language strings and comments indicate the skill is designed around a Chinese-language personality analysis mode, and the generated content and console messages are predominantly Chinese. There is no indication that the user can choose another language or that this locale restriction is documented as an explicit regional constraint.
The code analyzes conversation memory files and infers sensitive personality attributes from user text, including MBTI and Big Five traits. Inferring psychological characteristics from historical conversations without explicit consent creates a privacy and profiling risk, especially because the source data comes from ongoing personal interactions in an emotional-companion context.
The file explicitly establishes a feedback loop where historical conversations are analyzed, saved, and reused to shape future interactions. In an emotional-companion skill, this increases risk because the system can continuously adapt using sensitive inferences, potentially deepening manipulation, dependency, or privacy intrusion over time.
The skill's docstrings, usage text, trigger phrases, and response templates are written entirely in Chinese, which implies a fixed language/locale behavior. There is no indication that users can opt into another language or that the Chinese-only design is a documented regional constraint.
The function persists conversation-derived data, including a truncated user trigger string and mood history, to a local file under the user's home directory. Even though this supports an 'emotion memory' feature, it creates privacy risk because sensitive user content may be retained longer than expected, in plain form, and outside the immediate conversational context.
The code stores analyzed user input and emotional metadata to disk without any visible notice, consent flow, or opt-out. In a companion-style skill, users may share intimate or sensitive information, so silent persistence of conversation-derived content materially increases privacy and compliance risk.
The code appends plain-language user trigger text into a persistent mood history log, making sensitive disclosures recoverable from the filesystem. Because this skill is explicitly designed as an emotional companion, the captured text is more likely than usual to contain personal, mental-health, or relationship-related information.
The script's user-facing strings and usage instructions are presented in Chinese throughout, including the final guidance on how to interact with the skill. This is a natural-language locale policy concern because the skill appears to mandate a specific language experience without documenting user choice or opt-in.
The installer initiates analysis of historical conversations to build a personality profile during setup, which implies access to sensitive user data beyond what a typical install step should require. In the context of an emotional-companion skill, this is especially risky because intimate conversation history may contain highly personal or confidential information, and the behavior occurs automatically rather than through explicit, granular consent.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# Step 1: 分析性格生成 MBTI
print("\n📊 Step 1: 分析历史对话，生成多维度人格档案...")
result = subprocess.run(
[sys.executable, str(script_dir / 'analyze_personality.py')],
capture_output=False
)
The skill’s user-facing messages, usage text, and comments are entirely in Chinese, with no option for the user to select another language. Under the stated policy, forcing a specific language without opt-in is a locale/language policy violation unless clearly justified.
The script persists relationship interaction details, including free-form details, to a local JSON file under the user's home directory without any consent flow, retention notice, or minimization. In the context of an emotional-companion skill, those details are likely to contain sensitive personal and emotional information, so local persistence meaningfully increases privacy risk if the device, workspace, or logs are accessed by other users or tools.