Security audit

Emotion Detector

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it sends emotionally sensitive text to an external paid service and runs an npm payment client without enough privacy or provenance detail.

Review before installing. Only use this with explicit user consent for sending text to an external paid service, avoid submitting names, secrets, credentials, or unnecessary personal details, and run the payment client in a constrained environment with a dedicated low-limit wallet if possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:24
Finding: Unreviewed npm Package Is Downloaded and Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 24-28 **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: Medium ```bash npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/emotion-detector \ -X POST \ -d '{"text": "I feel really anxious about the presentation", "language": "en"}' ``` ### Technical Analysis The documented workflow uses `npx` to obtain and immediately execute `awal@2.0.3`. Pinning the package version provides some reproducibility, but the Skill does not specify an expected package integrity hash, trusted registry configuration, reviewed artifact, or isolated execution environment. If the referenced package version, npm account, registry, or dependency chain is compromised, package installation hooks or runtime code could execute arbitrary commands with the permissions of the user running the Skill. The command also initiates an x402 cryptocurrency payment workflow, which increases the sensitivity of any wallet or payment capabilities made available to the process. This is a supply-chain exposure rather than evidence that the identified package is currently malicious. ### Attack Path 1. A user or agent follows the command documented in `SKILL.md`. 2. `npx` resolves and, when not already cached, downloads `awal@2.0.3` and its transitive dependencies. 3. npm installation hooks or package runtime code execute under the invoking user's account. 4. A compromised package or dependency accesses files, environment variables, network resources, or credentials available to that process. 5. If wallet or payment authority is exposed to the command, malicious code could attempt unauthorized payment operations within the limits of that authority. ### Impact Assessment Successful exploitation could provide code execution with the invoking user's privileges. The affected scope could include readable local files, environment variables, acces ...[truncated 270 chars]
Remediation: ## Remediation Suggestions - Do not use an implicit download-and-execute workflow for security-sensitive or payment-related operations. - Review the package source, maintainer identity, release provenance, installation scripts, and transitive dependencies before use. - Install from a trusted registry using a lockfile and integrity-verified artifacts. - Document the expected package digest or other verifiable provenance mechanism. - Disable lifecycle scripts where they are unnecessary. - Execute the client in a sandbox or container with minimal filesystem and network access. - Remove unrelated secrets from the environment before invocation. - Use a dedicated wallet with strict spending limits and require explicit user confirmation before signing each payment.

other

Warning

Location: SKILL.md:25
Finding: Sensitive Emotional and Crisis-Related Text Is Sent to a Third-Party Service## Vulnerability Details **File Location**: `SKILL.md`, lines 25-36 **Vulnerability Type**: Sensitive data disclosure to an external API **Risk Level**: Medium ```bash npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/emotion-detector \ -X POST \ -d '{"text": "I feel really anxious about the presentation", "language": "en"}' ``` ```json { "text": "string (required, max 2000 chars) — the text to analyze", "context": "string (optional, max 500 chars) — additional context", "language": "en | ja (optional, default: en)" } ``` ### Technical Analysis The Skill directs agents to submit user-provided `text` and optional `context` fields to an externally hosted Railway endpoint. The intended data includes emotional-state and potential crisis-related content, which may contain personal, medical, mental-health, or identifying information. TLS protects the request in transit, but it does not prevent the external service operator from receiving, processing, logging, or retaining the plaintext content. The Skill does not document explicit user consent, data minimization, redaction, retention periods, service ownership, deletion procedures, or a privacy policy. No evidence shows that the endpoint is malicious or that disclosed data is currently being misused. The risk arises from transferring sensitive content outside the local trust boundary without documented privacy controls. ### Attack Path 1. A user provides a private message for emotional analysis. 2. The agent follows the Skill and places that message, and potentially additional context, into the API request. 3. The request transmits the content to `anicca-proxy-production.up.railway.app`. 4. The external service and its hosting or logging infrastructure can process or retain the submitted plaintext. 5. A service compromise, excessive retention, operator misuse, or unintended logging could expose the sensitive content. # ...[truncated 470 chars]
Remediation: ## Remediation Suggestions - Obtain explicit, informed user consent before transmitting content to the external service. - Clearly identify the service operator and provide its privacy, retention, deletion, and subprocessors policies. - Warn users not to submit passwords, authentication tokens, financial information, or unnecessary identifying details. - Redact names, contact details, account identifiers, and other unnecessary personal information before transmission. - Send only the minimum text required for analysis and omit optional context by default. - Establish contractual and technical controls for retention limits, deletion, access logging, and encryption at rest. - Provide a local or self-hosted analysis option for sensitive use cases. - Ensure crisis handling does not rely exclusively on an external classifier and clearly communicate that the service is not a medical diagnostic system.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill sends user-provided text to a remote third-party API and charges per request, but the documentation does not clearly warn users that their content leaves the local agent environment. Because the skill is explicitly designed to process emotionally sensitive text, this omission is more dangerous than usual: users may submit crisis-related, intimate, or mental-health disclosures without informed consent or awareness of third-party handling.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The input schema restricts `language` to `en | ja` with a default of `en`, which can constitute a language/locale policy concern when the skill is presented as a general-purpose emotion detector. The file does not justify this locale limitation or explain it as a region-specific constraint.

Static analysis

No suspicious patterns detected.