Security audit

Stoic Companion

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Stoic journaling companion that schedules reminders and stores personal reflections, with no hidden code or deceptive behavior found.

Before installing, choose a specific trigger phrase, verify the delivery channel and recipient, protect any TTS API key, and avoid storing personal details you do not want retained in memory. Treat the skill as reflective coaching, not professional or emergency mental-health support.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes broad phrases such as 'daily affirmation', 'anxiety support', and 'impulse control' that can overlap with ordinary user requests and unrelated wellness conversations. This can cause the skill to activate outside clear user intent, increasing the chance of unsolicited behavior, unintended memory writes, or creation of scheduled jobs for a sensitive mental-health-adjacent workflow.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The default on-demand trigger phrase 'I need to stop' is common natural language that a user may say in many contexts, including unrelated conversations or moments of distress. Because this skill responds with a structured intervention flow, an overly generic phrase can misfire, hijack interactions, and inappropriately steer users during sensitive situations.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.