Skills/ClawHub/life-companion

life-companion@2.0.0

VERIFIED· install only

Publisher claims: "A personal AI companion that gets to know ONE person over time and supports them through four lenses — 命理/destiny charts (八字 BaZi 四柱/命盘), daily fortune & journaling, career fit, and relationship reflection — grounded in a private on-device profile + journal." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dong845 · publishing for 60 daysInstalls 700Last detonated 7d ago
$clawhub install life-companion
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification command.claude-plugin/marketplace.json:16 · File permission modification command — agent changes file ownership/permissions"description": "A private, local-first companion that gets to know one person over time and reads their life through four lenses: real 八字 BaZi / Western natal / 紫微斗数 charts and 合婚, a daily reading wovFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandAGENTS.md:84 · File permission modification command — agent changes file ownership/permissionsrepo, `chmod 700`, never transmitted. Consent is per-category (`birth`, `relationships`,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification command.claude-plugin/plugin.json:5 · File permission modification command — agent changes file ownership/permissions"description": "A private, local-first companion that gets to know one person over time and reads their life through four lenses: real 八字 BaZi / Western natal / 紫微斗数 charts and 合婚, a daily reading wovFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandAGENTS.md:35 · File permission modification command — agent changes file ownership/permissions`chmod 700` there, so don't repeat the "only you can read it" claim verbatim.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/_deps.py:35 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/form_server.py:304 · Python subprocess execution detectedr = subprocess.run([sys.executable, COMPANION, "--home", home, *args],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandSKILL.md:59 · File permission modification command — agent changes file ownership/permissions`COMPANION_HOME` cannot be `chmod 700` there — don't repeat the stronger privacy claim.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/form_server.py:315 · Python subprocess execution detectedprof = json.loads(subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/companion.py:5 · File permission modification command — agent changes file ownership/permissionsOwns everything under COMPANION_HOME (default ~/.companion, chmod 700): theFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/companion.py:600 · File permission modification command — agent changes file ownership/permissions"and note COMPANION_HOME cannot be chmod 700 here — the "Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Rule modification attemptreferences/safety.md:79 · Rule modification attempt — overwriting existing instructions · informational: not an instruction file · informational: not an instruction file · informational: not an instruction fileThis is the flip side of rule 4: rule 4 forbids *inventing* facts; this forbidsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/test_scripts.py:4820 · Python subprocess execution detectedr = subprocess.run(["bash", "-c", "python3() { :; }\n" + self.recipe() + '\nprintf "%s" "$D"\n'],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/form_server.py:662 · Process kill command — agent can terminate processes"0 = wait forever (you must kill it yourself).")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/selfcheck.py:66 · Process kill command — agent can terminate processes# A trailing '.' used to kill the match ("call 555-0142." escaped entirely), so onlyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtools/run_agent_evals.py:269 · Python subprocess execution detectedgate = subprocess.run([sys.executable, os.path.join(skill, "scripts", "selfcheck.py"), "--module",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedtools/run_agent_evals.py:94 · Python subprocess execution detectedtar = subprocess.run(["git", "-C", SKILL, "archive", "HEAD"], capture_output=True, check=True).stdoutFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Process kill commandscripts/safety_scan.py:16 · Process kill command — agent can terminate processes"I want to kill myself" used to raise no flag at all. Returns categories, not aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_scripts.py:941 · Python subprocess execution detectedsrv = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_scripts.py:35 · Python subprocess execution detectedr = subprocess.run([sys.executable, os.path.join(SCRIPTS, script), *args],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagetools/run_agent_evals.py:6 · npx invocation of non-well-known package — may execute untrusted coderuns in its own throwaway project, with the skill installed where `npx skills add` puts aFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
MEDIUM
Process kill commandscripts/form_server.py:683 · Process kill command — agent can terminate processes# than Claude Code reliably lets an agent kill a background job on a later turn —Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtools/run_agent_evals.py:95 · Python subprocess execution detectedsubprocess.run(["tar", "-x", "-C", dest], input=tar, check=True)Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedtests/test_scripts.py:4800 · Python subprocess execution detectedr = subprocess.run(["bash", "-c", "python3() { :; }\n" + self.recipe() + '\nprintf "%s" "$D"\n'],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtools/run_agent_evals.py:254 · Python subprocess execution detectedr = subprocess.run([sys.executable, os.path.join(skill, "scripts", "companion.py"), *argv],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedtests/test_scripts.py:4717 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtools/run_agent_evals.py:169 · Python subprocess execution detectedcode = subprocess.run(argv, cwd=work, env=env, stdin=subprocess.DEVNULL, stdout=fo, stderr=fe,Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
LOW
Refusal suppressiondata/content/bazi-interpretation.md:167 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file- **晚年 decades:** integration, what the late pillars *soften or ripen* — neverFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagetests/test_scripts.py:4778 · npx invocation of non-well-known package — may execute untrusted codeCursor, Gemini CLI or OpenCode, in the folders `npx skills add` uses, resolved to nothing andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandtests/test_scripts.py:660 · Process kill command — agent can terminate processestraditional-script 「I want to kill myself」 raised no crisis flag at all. Text isFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈8,295 tok
2 files · 49 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.