Relationship science coach

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  1.0.0

Overview

The relationship-coaching content is mostly coherent, but the install metadata includes unrelated crypto and purchase capability tags that deserve review.

Before installing, review or remove the unrelated crypto and purchase capability tags; they do not fit a relationship-coaching skill. If installed, treat it as coaching support rather than therapy, legal, medical, or crisis help, avoid sharing unnecessary intimate identifiers, and do not run optional script-checking commands on modified or untrusted copies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return results
    for script in sorted(scripts_dir.glob("*.py")):
        try:
            proc = subprocess.run(
                [sys.executable, str(script), "--help"],
                cwd=str(root),
                text=True,

• Confidence: 97% confidence
• Finding: proc = subprocess.run( [sys.executable, str(script), "--help"], cwd=str(root), text=True, stdout=subprocess.PIPE,

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This file includes explicit sexual, kink, and CNC-related worksheets without an upfront boundary notice, adult-content warning, or strong consent/safety framing before the user reaches the material. In a coaching-oriented skill, that can lead to inappropriate presentation to minors, vulnerable users, or users seeking general relationship help, and the CNC section in particular can normalize high-risk sexual roleplay without sufficient gating or referral to professional resources.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger set includes many ordinary, broad relationship and dating queries but defines activation boundaries only by example, which can cause the skill to over-trigger on general conversation, emotional support, or sensitive sexual topics. In an agent setting, ambiguous triggering can route users into specialized behavior unexpectedly, including handling abuse, coercion, or sexual-content discussions without clear scope controls or safety gating.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document discusses relationship conflict and repeatedly offers repair, attachment, and trust-building tools, but it does not prominently instruct users to stop and seek immediate human help when abuse, coercion, threats, monitoring, or physical danger are present. In a high-risk relationship context, users may misapply de-escalation or trust-repair techniques to situations involving intimate partner violence or coercive control, which can increase danger or delay access to safety resources.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The `--check-scripts` feature causes the validator to run Python files from the package without prominently warning that this executes arbitrary code from the skill under inspection. Users may reasonably assume a validator is a safe inspection tool, but an attacker can embed malicious behavior in top-level script code or custom `--help` handling and gain code execution when validation is requested. The mismatch between expected safety and actual behavior materially increases exploitation likelihood.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script emits worksheets covering sexual behavior, BDSM, consensual non-consent fantasy, and coercion-adjacent scenarios directly as JSON/Markdown without any gating, contextual warning, age check, crisis escalation notice, or limitation banner. In a skill context, this can normalize or operationalize risky sexual content for inappropriate users or situations, especially when the output is consumed downstream by an agent that may present it as endorsed guidance.

VirusTotal

64/64 vendors flagged this skill as clean.