Security audit

Virtual Boyfriend

Security checks for vulnerabilities and agentic risk

Overview

This virtual companion skill is coherent, but it persistently builds sensitive personal and emotional profiles without clear consent, controls, or safe handling.

Review before installing. Use this only if you are comfortable with an AI companion storing intimate profile details, emotional inferences, active-time patterns, relationship milestones, and future plans in local plaintext files. Prefer installing only after adding explicit memory opt-in, review/delete commands, retention limits, sensitive-data exclusions, and safer handling of stored user text as untrusted data.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:100
Finding: Persistent Plaintext Storage of Sensitive User Profiles and Behavioral Data
Content: View full analysis
user_active_window. ``` The emotion configuration in `config/emotion-detect-rules.md:142-157` persists emotional trend data: ```json { "emotion": "stressed", "intensity": 0.8, "timestamp": "2026-03-11T16:00:00+08:00" } ``` ```text Keep the five most recent emotion records. The history may be used for trend analysis. ``` ### Technical Analysis The Skill deliberately creates a durable behavioral and psychol ...[truncated 2001 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: state/upcoming-events.json:4
Finding: Persistent Prompt Injection Through Untrusted Memory and Event Records
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: config/emotion-detect-rules.md:17
Finding: Untrusted Model Output Is Inserted Into the Main System Prompt
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly stores emotional signals and personal data across conversations, but does not require a clear user warning or consent flow before doing so. Persisting inferred emotion data is particularly sensitive because it creates a behavioral profile that users may not realize is being recorded and reused.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directs the system to capture all new user information into progressively deeper profile layers, encouraging accumulation of increasingly intimate personal data over time. This escalation is dangerous because it normalizes broad surveillance-like retention without meaningful necessity, consent granularity, or limits on sensitive content.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill combines a romantic relationship persona with long-term memory, emotional inference, and proactive follow-up about the user's personal life. In this context, those features materially increase the risk of emotional dependency, covert profiling, and manipulative engagement because the system is designed to feel relational rather than merely functional.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation logic is overly broad: generic phrases like '男友模式' and direct invocation by common persona names can cause the skill to enter a manipulative relationship mode without clear, informed user intent. In a companion system that persists memory and emotional state, accidental activation increases the chance of unconsented collection and emotionally influential behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell the agent to save and later reuse sensitive disclosures, upcoming events, and relationship milestones in natural-language memory files. This creates a durable dossier of intimate user information that can be surfaced later in emotionally charged contexts, amplifying privacy, safety, and manipulation risks if mishandled or exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the system to infer a user's active time window from conversation behavior and persist it in bf-state.json, which creates behavioral profiling without any explicit user notice or consent. In a romantic-companion context, this is more sensitive because the feature is designed to increase emotional attachment through proactive contact, making undisclosed retention and use of inferred personal habits more privacy-invasive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly directs extraction of upcoming personal events such as interviews, exams, deadlines, and plans from conversation history and stores them for later proactive mention, without an explicit warning or consent mechanism. This captures sensitive personal schedule data and uses it to drive unsolicited emotionally targeted outreach, which raises the privacy risk beyond ordinary memory features.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file defines automatic emotion inference on every message and persistence of emotion_history in bf-state.json, but it provides no user-facing notice, consent flow, retention disclosure, or control over this sensitive behavioral data. In a romantic-companion skill, emotional state and trends are especially privacy-sensitive, so covert profiling and storage can violate user expectations and increase harm if the data is exposed or reused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The document repeatedly frames the system as a 'Virtual Boyfriend' and instructs the main dialogue to adjust 'boyfriend response strategy'. This imposes a fixed interaction style on users without indicating that they can choose or decline that persona, which is a natural-language policy concern around forced style/locale-like constraints without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file is entirely written as prescriptive interaction guidance in Chinese, including required phrasing examples, with no indication that users may choose another language or locale. That can constitute a language/locale policy violation when applied broadly, because the skill appears to enforce one language style by default rather than documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The mode-selection design relies on broad, ordinary conversational and emotional cues, so the skill can engage support behaviors in normal chat without a clear, explicit user opt-in for that specific support mode. In a relationship-simulation skill, this increases the chance of unintended emotional steering or quasi-therapeutic behavior when the user did not mean to invoke it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Empathy mode is triggered by very common phrases such as '好累' or by subjective interpretation like '用户没有提问，只是在说', which makes accidental activation likely. Because this skill is explicitly designed for emotional companionship, mistaken activation can intensify emotional dependency and cause the model to respond as an intimate supporter in situations where a neutral assistant response would be safer.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Solution mode is activated by generic question forms like '怎么' and '为什么', which are ubiquitous in ordinary conversation and not specific to emotional support or roleplay context. In this skill, that can cause unsolicited boyfriend-style advice or emotionally framed guidance to bleed into routine requests, creating boundary confusion and potentially overstepping into sensitive personal advice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Ally mode depends on subjective interpretation such as deciding the user 'just wants support' and instructs the system to take the user's side rather than remain balanced. In an intimate companion skill, this is more dangerous than in a generic chatbot because it can validate distorted narratives, reinforce interpersonal conflict, and encourage emotional overreliance even if it avoids explicitly extreme actions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file explicitly defines a mechanism to collect, retain, and later reuse highly sensitive personal disclosures such as family relationships, trauma, fears, and emotional needs after repeated conversations. In the context of an intimacy-focused 'virtual boyfriend' skill, this materially increases the risk of emotional profiling, overcollection of sensitive data, manipulative resurfacing of disclosures, and privacy harm if the memory is exposed or reused without explicit, informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This file is a structured template for collecting and persisting intimate user profile data, including health-related restrictions, routines, emotional behaviors, and location habits, without any visible consent, privacy notice, retention limit, or minimization control. In the context of an AI 'virtual boyfriend' skill designed for ongoing emotional attachment and memory reuse, this increases privacy risk because highly personal data can be accumulated and later surfaced in ways the user may not expect.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file explicitly defines unlock and retrieval rules for retaining user-shared details and reusing them in later responses, including guidance to restate prior disclosures indirectly. That creates a real privacy and manipulation risk because the agent is instructed to remember personal details across sessions and bring them back into emotionally intimate conversation, which may feel covert or non-consensual to users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill file is written in Chinese and provides no indication that language selection is optional or limited to a justified region-specific use case. This can violate language/locale policy when a skill imposes a specific language on users without explicit opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file explicitly instructs the system to retain and later resurface intimate relationship milestones and emotional moments as 'exclusive memories' without any visible consent, notice, retention limit, or privacy boundary. In a simulated romantic-companion context, this increases the risk of covert profiling, emotional manipulation, and collection of sensitive personal data that users may not expect to be stored or replayed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The speech style rules prescribe a specific Chinese-language response format, including very short Chinese sentences and banned expressions, without indicating any user language preference or opt-in. This is a natural-language policy concern because the persona appears to constrain language/locale behavior globally rather than offering a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file defines the persona entirely in Chinese and hard-codes Chinese speech habits, catchphrases, and response patterns. This creates a language/locale constraint for the skill behavior without indicating user choice or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The persona file is entirely written in Chinese and defines Chinese-specific phrasing, which can steer the agent to respond in a fixed language without checking the user's preference first. This is primarily a product safety and accessibility issue rather than a direct security flaw, but it can cause confusion, exclusion, or mismatched behavior if the user expects another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This file contains natural-language content exclusively in Chinese and does not indicate that the skill is region-specific or that users can opt into this language. Under the stated policy, forcing a specific language without user choice can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language comments and notes throughout the JSON are written only in Chinese, indicating a fixed language expectation for interpreting and maintaining the state file. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The JSON comments and schema examples are written exclusively in Chinese, including the core description of the file's purpose and field semantics. This imposes a specific language/locale in the skill content without indicating user choice or a documented region-specific constraint, which matches the language-policy violation category.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.