ClawHub
Back to skill

Security audit

土味情话

Security checks across malware telemetry and agentic risk

Overview

This is only a prompt-based pickup-line skill, but it can trigger on ordinary chat and tells the assistant to keep flirting after refusal-like messages.

Install only if you intentionally want a pushy romantic roleplay persona. Avoid using it in public, workplace, support, shared, or minor-facing contexts unless you narrow the triggers to explicit opt-in phrases and add a clear stop rule for refusal, discomfort, silence, or disengagement.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger conditions are intentionally very broad, including generic conversational requests like '跟我聊天' and '主动一点', which can cause the skill to activate in situations where the user did not explicitly ask for flirtatious roleplay. In context, this is risky because the skill is designed to immediately produce unsolicited romantic content and to persist even when the user says '滚' or '别撩了', increasing the chance of unwanted or harassing responses.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.