ClawHub
Back to skill

Security audit

EFT - Emotional Framework Translator

Security checks for vulnerabilities and agentic risk

Overview

This skill is an emotion-analysis monitor, but it automatically captures agent responses, stores response-derived text, and exposes history through unauthenticated local HTTP endpoints.

Review before installing. Use this only if you are comfortable with agent outputs being automatically analyzed, logged locally, and made available through the EFT API. Avoid sensitive workloads unless you restrict gateway access, remove wildcard CORS, add authentication, choose trusted engine/log paths, and set retention or deletion controls for logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
plugin/index.ts:226
Finding

Unauthenticated API Disclosure of Captured Agent Responses

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
plugin/index.ts:62
Finding

Unbounded Plaintext Retention of Agent Response History

Content
View full analysis
{ try { return JSON.parse(l); } catch { return null; } }).filter(Boolean); console.log(`[eft] Loaded ${history.length} entries from log`); } catch {} } ``` ```typescript latestResult = entry; history.push(entry); analysisCount++; appendLog(logPath, entry); ``` ### Technical Analysis Every analyzed response is appended as plaintext JSON to a persistent JSONL file. Records contain complete sentence text and related metadata. The implementation has no age-based expiration, maximum file size, record limit, rotation policy, deletion mechanism, or explicit restrictive file mode. At startup, the entire log is read synchronously and loaded into the global `history` array. Although the HTTP history response returns only 50 entries, the underlying file and in-memory array remain unbounded. Persistent storage supports the documented dashboard history function, but indefinite retention of raw response content is not necessary to provide a recent-history dashboard and violates data-minimization principles. ### Attack Path **Confidentiality path:** 1. The plugin continuously appends agent response records to `eft_log.jsonl`. 2. Sensitive records remain present indefinitely unless an operator manually removes the file. 3. A local user, c ...[truncated 1016 chars]
Remediation
View remediation

other

Note
Location
eft_dashboard.html:8
Finding

Dashboard Loads an External Google Fonts Resource

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
Findings (27)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · EFT_SCIENTIFIC_EVIDENCE.md (reported line 1)May include surrounding context.

md
# EngineMind EFT - Scientific Evidence & Market Research
## Emotional Framework Translator: Research Compilation

> **Compiled:** February 2026

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

A skill that intercepts and analyzes every AI agent response materially affects privacy and data handling, yet the description does not prominently warn users about this behavior. Because model responses may contain secrets, personal data, or proprietary content, silent interception significantly raises the risk of unauthorized exposure or retention.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

Spawning a Python interpreter is not inherently malicious, but it introduces a powerful execution boundary that depends on local interpreter and module resolution. Here the plugin executes code from a user-home Desktop path and inherits the full process environment, so a tampered script or module in that location could run arbitrary code with the host application's privileges.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The plugin stores and serves a rich record of agent outputs, sentence analyses, text previews, timestamps, token usage, session keys, and other metadata as a built-in memory/history feature. This creates a durable sensitive-data repository and direct disclosure channel that is broader than needed for emotion analysis and materially raises privacy, confidentiality, and local attack-surface risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The plugin exposes unauthenticated HTTP endpoints that return the latest analysis, recent history, and allow arbitrary ad hoc analysis requests. Because the history includes response-derived content and session/process metadata and CORS is set to '*', any reachable local or proxied web origin may be able to read sensitive data or drive analysis without user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation explicitly states that EFT 'intercepts every response an AI agent produces' and later describes capture of text, model, tokens, latency, tool calls, plus JSONL logging and dashboard display. That is privacy-sensitive monitoring behavior, and the absence of a prominent warning, consent guidance, retention notice, and scoping controls creates a real risk of unintended collection and persistence of secrets, personal data, and regulated content.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · EFT_DOCUMENTATION.md (reported line 83)May include surrounding context.

Architecture

text
┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · EFT_DOCUMENTATION.md (reported line 89)May include surrounding context.

Architecture

text
┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · EFT_DOCUMENTATION.md (reported line 86)May include surrounding context.

md
┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘
                      │
                      â–¼
┌─────────────────────────────────────────────────────────────┐

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · EFT_DOCUMENTATION.md (reported line 92)May include surrounding context.

md
┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘
                      │
                      â–¼
┌─────────────────────────────────────────────────────────────┐

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · EFT_DOCUMENTATION.md (reported line 86)May include surrounding context.

md
┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘
                      │
                      â–¼
┌─────────────────────────────────────────────────────────────┐

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · EFT_DOCUMENTATION.md (reported line 92)May include surrounding context.

md
┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘
                      │
                      â–¼
┌─────────────────────────────────────────────────────────────┐

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · EFT_DOCUMENTATION.md (reported line 108)May include surrounding context.

md
└────┬─────┘ └────┬─────┘ └────┬─────┘
        │             │             │
        â–¼             â–¼             â–¼
   ┌──────────────────────────────────────┐
   │         EmotionMapper                 │
   │  phi, NC, MA, CL, arousal, dims     │
   │  → Calibrated Rules → 10 Emotions    │

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · EFT_DOCUMENTATION.md (reported line 519)May include surrounding context.

Analyze arbitrary text.

bash
curl -X POST http://localhost:18789/eft/api/analyze \
  -H "Content-Type: application/json" \
  -d '{"text": "Your text to analyze here"}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · EFT_SCIENTIFIC_EVIDENCE.md (reported line 50)May include surrounding context.

md
| Tool | Type | Limitation vs. EFT |
|---|---|---|
| **VADER** (Hutto & Gilbert) | Lexicon-based sentiment | Positive/negative/neutral only; no complex emotions |
| **TextBlob** | Pattern-based polarity | Simplistic; no emotional granularity |
| **Hugging Face Emotion Pipelines** | Transformer-based classification | Standard 6-8 emotion classes; no narrative arc or consciousness metrics |
| **IBM Watson Tone Analyzer** (deprecated) | API-based tone detection | Discontinued; was limited to 7 tones |
| **Amazon Comprehend** | Cloud sentiment API | 4-class sentiment only (pos/neg/neutral/mixed) |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares runtime requirements and setup steps that enable code execution and likely environment access, but it does not declare a corresponding tool scope or permission boundary. That mismatch makes the skill's capabilities less transparent and can lead users or hosting systems to activate it without understanding that it can process data through local components and plugins.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description is written broadly enough to apply to "any AI model" and implies pervasive integration, which can cause the skill to activate in many unrelated contexts. Over-broad activation increases the chance of unnecessary interception and analysis of sensitive model outputs that the user did not intend to route through this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly states it hooks into every AI agent response, but it provides no limiting conditions or precise invocation guardrails. In practice, this can turn the skill into a passive interceptor for broad amounts of conversational data, creating privacy, consent, and data-minimization risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The UI explicitly states that the EFT hook captures each agent response automatically, but it provides no meaningful notice, consent flow, or privacy explanation about what content is collected, retained, or displayed. In a tool that monitors model outputs, this can expose sensitive prompts, responses, or proprietary data to users who may not realize monitoring is active.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · eft_dashboard.html (reported line 112)May include surrounding context.

html
// Try gateway API first, fallback to standalone
    let url = "/eft/api/history";
    let r = await fetch(url).catch(()=>null);
    if(!r||!r.ok) { r = await fetch("http://localhost:8889/api/history").catch(()=>null); }
    if(!r||!r.ok){
      // Try loading from log file via standalone server
      document.getElementById('statPill').textContent='API unavailable';

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The code inspects environment variables such as USERPROFILE and HOME to locate executables and log files under the user's desktop. For a skill described only as emotion analysis, accessing host environment configuration and user filesystem locations is an additional host-integration capability not justified by the manifest description alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The plugin forwards agent response text to an external Python process for analysis, which is a cross-component data transfer not visible to end users. While local, it still increases exposure because the child process, imported modules, and any errors or future modifications could access or mishandle sensitive response data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The plugin persists analyzed outputs and related metadata to disk, which expands its behavior from transient emotion analysis into durable collection of model responses. In this context the logged entries include text previews, sentence-level analysis, and process/session metadata, creating a privacy and data-retention risk if the host is multi-user, compromised, or the log is later exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Assistant response content and derived emotional analysis are appended to a local JSONL log without any evident consent, disclosure, or retention control. Even the stored preview and sentence-level outputs can contain secrets, personal data, or sensitive business content produced by the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The HTTP endpoints expose latest and historical analysis results, including content-derived fields, without any user-facing warning or access control. In context this is more dangerous because the skill processes AI responses that may contain confidential prompts, outputs, or identifiers, and then republishes them over a simple API.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
plugin/index.ts:41