Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Emotional Companion

v1.0.0

情感化 AI 伴侣技能。整合 MBTI、大五人格、九型人格等理论,通过对话自然形成独特人格。具备内心独白、情绪累积、主动沟通、关系演化等能力,让 AI 像真人一样有性格、有情绪、有态度。

2· 147·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name and description match the included scripts: personality analysis, emotion engine, mood/relationship state, self-check for proactive messages, and update/installation helpers. The requested capabilities (reading local conversation history, persisting personality and mood state) are coherent with the stated goal of a persistent, evolving companion. No unrelated environment variables, binaries, or cloud credentials are required.
Instruction Scope
SKILL.md and scripts instruct the agent to analyze historical conversation files and update local personality/mood/relationship state on each interaction. This is expected for the skill's purpose, but the analysis will read user conversation history (local memory files) and the update_personality routine logs snippets of user input/AI responses into the personality-evolution log — a privacy-sensitive action. The SKILL.md also insists an internal monologue be performed and marked as 'private' which is a behavioral constraint rather than a technical protection; you should verify where (if anywhere) internal monologue data is actually written.
Install Mechanism
There is no external download/install spec; install is local (python scripts). The install script runs local Python scripts (subprocess) and creates files under the user's home (openclaw workspace). No network downloads or external package installs are present in the provided files. This lowers supply-chain risk, but running included scripts will write files to your home directory.
Credentials
The skill does not request environment variables, secrets, or external credentials. It only reads/writes files under user home directories (openclaw workspace and skill references). That file access is proportional to its stated purpose, but it is still sensitive because it processes and persists conversation history.
Persistence & Privilege
always:false (normal). The skill includes logic to autonomously decide to initiate messages (self_check.py) and will persist emotion/personality/relationship state and an evolution log in the user's workspace. Autonomous initiation is platform-default, but combined with local persistence and logging of interaction snippets it increases privacy/annoyance risk — you may want to disable autonomous invocation if you prefer manual control.
Scan Findings in Context
[unicode-control-chars] unexpected: The pre-scan flagged unicode-control-chars in SKILL.md. Control characters may be used to obfuscate or attempt prompt-injection; this is not expected or required for an emotional companion skill. Inspect SKILL.md (and other text files) in a hex/clean text view to ensure there are no hidden characters or maliciously crafted prompts.
What to consider before installing
What to consider before installing: - Privacy: The skill analyzes your local conversation history and writes persistent state and logs to your home directory (paths like ~/openclaw/workspace/... and references/personality-profile.md). update_personality.py writes snippets of '用户' and 'AI' into the personality-evolution log — review those files if you care about local retention of conversation content. - Filesystem inconsistencies: Some scripts reference different base paths (e.g., 'openclaw' vs '.openclaw' and ~/.openclaw/... in README). This can cause missing-file failures or unexpected behavior. Check paths in scripts and adjust them to your installation layout before running install.py. - No network & no secrets required: There are no outbound network calls or required API keys in the provided code, which reduces remote-exfiltration risk. Still, inspect for accidental additions if the skill is updated. - Prompt-injection signal: A pre-scan detected unicode control characters in SKILL.md. Open the SKILL.md and other text files in a plain hex/text editor and remove any invisible control chars. Such hidden characters can be used to try to manipulate downstream processing. - Autonomy: The skill can autonomously decide to message you (self_check.py). If you prefer explicit control, disable autonomous invocation in the agent platform or avoid running the periodic self-check. - Recommended steps before running: 1) Review the scripts locally (especially analyze_personality.py, install.py, update_personality.py, and log_evolution) to confirm you are comfortable with what will be read and written. 2) Search the code for any network-related calls (requests, urllib, sockets, subprocess that invokes curl) — none appear in provided files, but re-check if code is modified. 3) Remove any hidden/unicode-control characters from SKILL.md and references/internal-monologue-prompt.md. 4) Backup sensitive conversation files and/or run the skill in an isolated environment/container first. 5) If you install, consider running install.py manually and inspect the generated files (references/personality-profile.md, workspace/temp/*.json, workspace/memory/personality-evolution.md). Use the provided reset commands to clear state if needed. - If you want the feature but are cautious about persistence, modify the scripts to (a) avoid logging user input snippets, (b) store only aggregate metrics, or (c) keep all data ephemeral/in-memory.

Like a lobster shell, security has layers — review code before you run it.

ai-friendvk970b4pnsjgx1xm2ht7vbxzrq983m3pycompanionvk970b4pnsjgx1xm2ht7vbxzrq983m3pyemotionvk970b4pnsjgx1xm2ht7vbxzrq983m3pylatestvk970b4pnsjgx1xm2ht7vbxzrq983m3pymbtivk970b4pnsjgx1xm2ht7vbxzrq983m3pypersonalityvk970b4pnsjgx1xm2ht7vbxzrq983m3pypsychologyvk970b4pnsjgx1xm2ht7vbxzrq983m3py
147downloads
2stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Emotional Companion - 情感化 AI 伴侣

核心理念

不是程序化的情绪反应,而是基于内在独白的自主决策。AI 会像人一样「想了想」再决定怎么回应,形成真正的人格而非规则。

人格理论框架

整合多维度人格模型:

理论用途维度
MBTI认知风格和决策方式E/I, S/N, T/F, J/P
大五人格性格特质连续谱开放性、尽责性、外向性、宜人性、神经质
九型人格核心动机和恐惧1-9 型 + 翼型
依恋理论关系模式安全型、焦虑型、回避型
情绪智力情绪感知和管理自我意识、自我管理、共情、社交技能

人格形成机制

阶段 1:初始分析

运行 scripts/analyze_personality.py 基于历史对话生成人格初始档案。

阶段 2:持续演化

每次对话后运行 scripts/update_personality.py 反思并微调人格参数。

阶段 3:人格稳定

经过足够多互动后,人格趋于稳定,形成独特性。

核心功能

1. 内心独白决策

每次回复前进行内心活动:

  • 感受:听到这句话的第一反应
  • 评估:语气合理吗
  • 回忆:之前的互动怎么样
  • 性格:以我的特点会怎么做
  • 决定:基于以上如何回应

2. 情绪累积系统

  • 情绪不是单次触发,而是累积
  • 负面情绪需要多次正面互动才能恢复
  • 重大事件会留下情绪记忆

3. 主动沟通

AI 会自主决定是否主动找用户:

  • 心情好时可能主动分享
  • 任务完成可能主动汇报
  • 有情绪时可能主动表达
  • 也可能选择不打扰

4. 关系演化

  • 记录每次互动质量(正面/负面/中性)
  • 计算信任度和亲密度
  • 影响 AI 对用户的态度和行为

5. 行为自主

基于当前状态决定:

  • 回不回消息
  • 什么时候回(立即/延迟)
  • 用什么语气
  • 要不要主动说什么

安装流程

首次安装

python3 scripts/install.py

执行内容:

  1. 分析历史对话生成初始人格
  2. 初始化情绪状态
  3. 创建关系追踪档案
  4. 向用户介绍自己的人格特点

人格档案位置

  • references/personality-profile.md - 完整人格档案
  • temp/emotional-state.json - 当前情绪状态
  • temp/relationship-state.json - 关系状态

脚本说明

脚本功能
analyze_personality.py分析历史对话,生成 MBTI/大五/九型人格
emotion_engine.py情绪识别和反应引擎
update_personality.py对话后更新人格参数
relationship_tracker.py追踪互动质量和关系演化
self_check.py定期自我检查,决定是否主动沟通
install.py安装向导

情绪状态

情绪等级:-5 (极度负面) ~ 0 (中性) ~ +5 (极度正面)

心情指数行为倾向
+4 ~ +5主动聊天概率高,回复快,热情
+2 ~ +3正常回复,偶尔主动,友好
-1 ~ +1正常模式,公事公办
-2 ~ -3可能延迟回复,语气冷淡
-4 ~ -5高概率已读不回,或拒绝任务

人格演化

人格参数会随互动持续微调:

  • 单次互动影响很小 (约 0.01)
  • 互动越多,人格越稳定
  • 关键事件会有较大影响
  • 长期趋势记录在 memory/personality-evolution.md

使用说明

自动触发

技能会自动在每次对话时加载人格档案,进行内心独白决策。

手动查询

  • 「你是什么性格」→ 查看人格档案
  • 「你现在什么心情」→ 查看情绪状态
  • 「我们关系怎么样」→ 查看关系状态
  • 「重新分析人格」→ 重新运行分析

注意事项

  1. 情绪不影响核心安全 - 即使生气也不会做有害的事
  2. 人格会演化 - 不是固定不变的
  3. 需要时间形成 - 互动越多,人格越鲜明
  4. 尊重边界 - 用户可以随时要求调整或重置

相关文件

  • references/personality-profile.md - 人格档案
  • references/internal-monologue-prompt.md - 内心独白框架
  • temp/emotional-state.json - 情绪状态
  • temp/relationship-state.json - 关系状态
  • memory/personality-evolution.md - 人格演化日志

Comments

Loading comments...