Body Emotion Sensor

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  1.0.3

Overview

This is an instruction-only skill for a local persistent emotion-state CLI, with one narrow consent concern around changing the CLI language setting.

Install this only if you want an agent to keep local emotion/persona state across sessions. Approve the Python package install only after verifying the package source, and ask the agent to confirm before changing language settings or writing persistent state files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly says the agent may suggest or run `bes language zh` based on the user's language being Chinese, but it does not require explicit user consent before changing a persistent local configuration. Because this writes to a user-level config file and changes future behavior beyond the current request, inferred language alone is not sufficient authorization and can result in unwanted persistent preference changes.

VirusTotal

65/65 vendors flagged this skill as clean.