Security audit

Rong Bing

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a customer-service de-escalation persona, but its instructions include broad activation and user emotion-steering language that needs human review before installation.

Install only if you explicitly want a bounded roleplay/customer-service de-escalation persona. Review and narrow the activation terms, require user opt-in before emotion analysis, and remove language that frames empathy as a way to bypass resistance or prepare users for probing by another role.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes broad everyday terms like '客服', '安抚', and '亲和沟通', which can activate the skill in unrelated conversations. In a skill designed to classify emotions and steer user affect, accidental activation creates unconsented behavioral profiling and influence risk rather than a harmless UX issue.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The usage rules instruct the agent to automatically scan each new conversation for emotional state and anger type, but do not define a clear boundary for when the skill is active. This can cause the model to apply hidden profiling and de-escalation tactics by default, including outside a user-requested customer-service roleplay context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly directs the agent to scan, classify, label, and steer user emotions, then restore a sense of control before presenting solutions, without requiring transparent notice or consent. This is dangerous because it operationalizes covert affective manipulation and psychological profiling, especially when the user may not realize they are being analyzed.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger conditions are broad enough to activate the persona in generic customer-service, calming, or simulation contexts without clear user opt-in or narrow scope boundaries. That increases the chance the model applies emotion-reading and influence tactics in ordinary conversations where the user did not explicitly request this role or manipulation-oriented framework.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The file mandates use of a specific 'customer-service Chinese' style without accounting for the user's language, locale, or preference. This can override user autonomy and make the assistant present as an institutional or culturally coded persona even when the interaction did not request that framing, which is especially problematic in sensitive emotional contexts.

Ssd 4

Medium

Confidence: 94% confidence
Finding: The role narrative normalizes emotional modeling and staged influence as a method to soften defenses and make targets more receptive. In context, the skill is not just empathic support; it codifies tactics for reducing resistance and shaping user decisions, which can be abused for manipulation in customer, complaint, or conflict settings.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The instructions direct the agent to profile the user's emotional state, force an emotion-labeling step within the first three turns, and only then present solutions. This creates a scripted manipulation pipeline that can override user preferences, infer sensitive mental state, and push users into a guided interaction they did not explicitly request.

Ssd 4

Medium

Confidence: 88% confidence
Finding: This section explicitly describes a multi-role setup where emotional soothing is used to prepare another role to create a 'breakthrough' with a defended target. Framing emotional regulation as a precursor to further probing turns empathy into an influence primitive and can facilitate coercive persuasion or boundary erosion in simulated or real interactions.

Ssd 4

Medium

Confidence: 91% confidence
Finding: The text says acceptance-based trust can bypass defenses and become a 'unique threat' to the target, which is a direct articulation of trust-building as a defensive bypass mechanism. That is dangerous because it normalizes covert psychological access and can be repurposed for social engineering, manipulation, or exploitation of emotionally vulnerable users.

Ssd 4

High

Confidence: 95% confidence
Finding: This is the clearest harmful pattern: one role performs emotional softening specifically to create a foothold for another role to probe and advance its goals. That is a coordinated manipulation workflow, and in context it materially increases the risk of coercive persuasion, elicitation, and exploitation under the cover of customer care or empathy.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.