EmoClaw

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:51 AM UTC
• Version: 1.0.6

Overview

EmoClaw is a disclosed local emotion-state skill that reads configured memory files and can optionally send extracted passages to Anthropic for labeling with consent.

Before installing, review the configured bootstrap source files, inspect extracted_passages.jsonl before any labeling, keep ANTHROPIC_API_KEY unset unless you intend to send passages to Anthropic, avoid running the daemon as root, and consider pinning dependencies or skipping the default pytest install in stricter environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# --- Install dev dependencies ---
    print("  Installing dev dependencies (pytest)...")
    subprocess.run(
        [str(pip), "install", "pytest"],
        capture_output=True,
        text=True,

• Confidence: 77% confidence
• Finding: The setup script automatically installs an additional package from package indexes, which expands the attack surface and can execute arbitrary code through dependency installation workflows. In a skill setup context, silently pulling unnecessary external software is riskier because users expect initialization, not network-based dev tooling changes.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents capabilities to read local files, write persistent state and training artifacts, create a virtual environment, invoke shell commands, and optionally send extracted passages to an external API, yet no explicit permission declaration is present. This increases the chance that an operator enables the skill without understanding its actual access level, especially because it touches identity/memory files and can exfiltrate their contents during the labeling step.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The advertised purpose focuses on emotional state generation, but the documented behavior also includes repository-wide file extraction, package installation into the host project, daemon/socket exposure, and optional transmission of extracted content to Anthropic. That mismatch is security-relevant because users may grant trust based on a narrow mental model while the skill actually performs broader and riskier operations involving sensitive local data and prompt injection.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: Installing pytest is unrelated to the core function of initializing an emotion-state skill and introduces unnecessary third-party code execution and dependency risk. Because this occurs during first-time setup, users may unknowingly allow network installs and package-side effects that are not required for operation.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: This diagnostic script prints raw input messages alongside the model’s inferred emotional state, which can expose sensitive conversational content and behavioral profiling data in logs or terminal history. In the context of a memory- and identity-driven emotional modeling skill, those outputs are more privacy-sensitive than ordinary debug data because they may reveal relationship signals and personalized internal state derived from user interactions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The architecture explicitly persists an emotion vector, GRU hidden state, timestamps, message counts, and trajectory across sessions, but provides no warning or privacy guidance about retaining sensitive conversational and inferred emotional history. In a skill designed to build a long-lived emotional fingerprint from user interactions, this omission increases the likelihood that deployers will store personal or behavioral data without appropriate minimization, consent, retention limits, or protection.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script extracts passages from identity and memory files and persists them to `extracted_passages.jsonl` without an explicit user-facing warning, confirmation step, or restrictive file-permission handling. In this skill’s context, the source material is especially likely to contain intimate or identifying content, so silently writing a consolidated dataset to disk increases the chance of unintended disclosure through backups, logs, sharing, or later processing.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

torch>=2.0.0
sentence-transformers>=2.2.0
numpy>=1.24.0

• Confidence: 92% confidence
• Finding: The dependency is specified with only a lower bound, which allows future installs to resolve to any newer release, including versions with breaking changes or newly introduced supply-chain or security issues. For a security-sensitive ML stack, unpinned packages reduce build reproducibility and make it harder to audit exactly what code is being deployed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

torch>=2.0.0
sentence-transformers>=2.2.0
numpy>=1.24.0

• Confidence: 90% confidence
• Finding: Using an unpinned sentence-transformers version permits installation of arbitrary later releases and transitive dependency changes, which increases supply-chain risk and can silently alter model-loading behavior. In an agent skill that processes conversational memory and identity-related data, dependency drift can expand the attack surface in difficult-to-review ways.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

torch>=2.0.0
sentence-transformers>=2.2.0
numpy>=1.24.0

• Confidence: 88% confidence
• Finding: Although numpy is common and generally lower risk than higher-level ML frameworks, leaving it unpinned still weakens reproducibility and can introduce vulnerable or incompatible builds during future installs. This is a real supply-chain hygiene issue even if the direct exploitability is lower than for model-loading libraries.

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The dependency specification allows any torch release at or above 2.0.0 and does not exclude versions with known critical advisories. In an AI skill centered on model state and memory, PyTorch is likely to be exercised directly, which makes unsafe deserialization or model-loading flaws especially relevant and increases the chance that a vulnerable runtime could lead to code execution or denial of service.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 74% confidence
• Finding: The package allows any numpy version at or above 1.24.0 without constraining away versions tied to published advisories. While many NumPy CVEs are context-dependent and may require local access or specific unsafe usage patterns, leaving the dependency broadly unpinned still exposes consumers to known vulnerable builds and unnecessary attack surface.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: PyYAML has a long history of dangerous deserialization issues, and the dependency declaration permits versions at or above 6.0 without demonstrating that only safe loaders are used. In a skill that persists agent state and may ingest identity or memory files, YAML parsing of untrusted content is plausible, making deserialization flaws more operationally dangerous in this context.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: engine/emotion_model/tests/test_model.py:74