emo-img — Give Your AI Emotional Expression

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.0

Overview

This is mostly a real sticker-sending skill, but it needs Review because its file handling is not safely confined to the sticker folder and it can automatically download and send media.

Review before installing. Use it only where automatic media sending is acceptable, confirm the target chat before sending, avoid sensitive search terms because online fallback contacts Tenor, and patch or constrain file handling so sticker names and indexed paths cannot write, send, or delete files outside the sticker directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tainted flow: 'req' from os.environ.get (line 164, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

try:
        req = urllib.request.Request(url, headers={"User-Agent": "OpenClaw-Sticker/1.0"})
        with urllib.request.urlopen(req, timeout=15, context=_ssl_context()) as resp:
            dest_file.write_bytes(resp.read())
    except Exception as e:
        print(f"Download failed: {e}", file=sys.stderr)

• Confidence: 95% confidence
• Finding: with urllib.request.urlopen(req, timeout=15, context=_ssl_context()) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill uses environment variables, local file read/write, and network access, but declares no permissions or equivalent user-facing capability boundary. That makes it easier for the agent to perform downloads, persist files, and access local sticker paths without transparent consent or policy enforcement, increasing the risk of unintended data access and external network use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The description frames the skill as searching, downloading, and sending sticker images, but the documented behavior also includes listing and removing local stickers. Hidden or under-disclosed destructive and inventory actions can surprise users and be abused to enumerate local content or delete saved media outside the user's expectation of a simple 'send sticker' skill.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: If certificate discovery fails, the helper explicitly disables hostname checking and certificate validation. That permits silent interception of HTTPS traffic, allowing attackers on the network path to tamper with Tenor searches or sticker downloads and substitute arbitrary content.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README encourages very broad natural-language triggering such as ordinary requests for stickers or reactions, which can cause the skill to activate in routine conversation without clear user confirmation. In a messaging skill that can send media across external channels, overbroad invocation increases the chance of unintended outbound actions and surprise data handling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README advertises automatic sticker sending with fallback to Tenor but does not warn that user queries or metadata may be transmitted to a third-party service and that media may be sent externally on the user's behalf. This lack of disclosure is risky because the skill operates in a cross-channel messaging context, where unintended network access and message sending are meaningful side effects.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation description is broad enough that ordinary chat phrases about emojis, memes, or stickers could trigger the skill automatically. In this skill's context, activation can lead to network searches, downloads, local file writes, and sending media to external channels, so over-triggering materially increases the chance of unintended external actions.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The workflow examples use vague prompts like '发个表情包' or 'send a sticker about X' without constraints on whether the agent should search online, download files, or immediately send to a detected channel. Ambiguous examples can cause the skill to activate and act on incomplete intent, increasing the risk of accidental downloads, persistence, or unintended outbound messaging.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description does not warn that it may download third-party media from Tenor, store it locally, and send it through external messaging channels. Without that disclosure, users may not realize their requests can trigger network access, local persistence, and outbound sharing, which raises privacy, consent, and content-safety concerns.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.