EFT - Emotional Framework Translator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:57 PM UTC
• Version: 1.4.0

Overview

This skill is an emotion-analysis monitor, but it automatically captures agent responses, stores response-derived text, and exposes history through unauthenticated local HTTP endpoints.

Review before installing. Use this only if you are comfortable with agent outputs being automatically analyzed, logged locally, and made available through the EFT API. Avoid sensitive workloads unless you restrict gateway access, remove wildcard CORS, add authentication, choose trusted engine/log paths, and set retention or deletion controls for logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: plugin/index.ts:226
• Finding: Unauthenticated API Disclosure of Captured Agent Responses<![CDATA[ ## Vulnerability Details **File Location**: `plugin/index.ts`, lines 179-194 and 226-243 **Vulnerability Type**: Unauthenticated sensitive-data exposure with wildcard CORS **Risk Level**: High ### Vulnerable Code ```typescript const entry = { ts: new Date().toISOString(), emotion: result.global.emotion, confidence: result.global.confidence, label: result.global.label, color: result.global.color, secondary: result.global.secondary, sec_conf: result.global.sec_conf, desc: result.global.desc, why: result.global.why, arc: result.arc, peak: result.peak, metrics: result.global.metrics, dim_profile: result.global.dim_profile, scores: result.global.scores, sentences: result.sentences, n: result.n, analysisMs: result.analysis_ms, process: pm, textPreview: text.slice(0, 200), }; latestResult = entry; history.push(entry); analysisCount++; appendLog(logPath, entry); ``` ```typescript if (p === "/eft/api/latest") { res.setHeader("Content-Type", "application/json"); res.setHeader("Access-Control-Allow-Origin", "*"); res.end(JSON.stringify(latestResult ?? { status: "awaiting_first_analysis" })); return true; } if (p === "/eft/api/history") { res.setHeader("Content-Type", "application/json"); res.setHeader("Access-Control-Allow-Origin", "*"); res.end(JSON.stringify({ count: history.length, entries: history.slice(-50).reverse() })); return true; } ``` ### Technical Analysis The `agent_end` handler automatically captures assistant responses and stores complete sentence-level text in `result.sentences`, peak-segment text in `result.peak`, the first 200 characters in `textPreview`, and associated session and process metadata. The `/eft/api/latest` and `/eft/api/history` routes return these records without implementing authentication, authorization, or caller validation. Both endpoints also set `Access-Control-Allow-Origin: *`, permitting JavaScript from any web origin to read responses when the EFT gateway is r ...[truncated 1704 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require authenticated gateway sessions for every `/eft` and `/eft/api/*` route. 2. Add explicit authorization checks so only designated administrators or session owners can access captured records. 3. Remove `Access-Control-Allow-Origin: *`. Use an exact, configurable allowlist for trusted dashboard origins. 4. Reject requests with untrusted `Origin` headers and add CSRF protection where cookie-based authentication is used. 5. Bind the service to loopback by default and clearly warn operators before allowing remote exposure. 6. Store derived emotion metrics rather than raw response text by default. 7. Make raw-text capture an explicit opt-in setting and support field-level redaction. 8. Separate records by session or user and enforce ownership checks before returning them. 9. Add security tests verifying that unauthenticated and cross-origin requests cannot access response data. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: plugin/index.ts:62
• Finding: Unbounded Plaintext Retention of Agent Response History<![CDATA[ ## Vulnerability Details **File Location**: `plugin/index.ts`, lines 62-78 and 191-194 **Vulnerability Type**: Unbounded plaintext logging and in-memory retention **Risk Level**: Medium ### Vulnerable Code ```typescript function appendLog(logPath: string, entry: any) { try { const dir = path.dirname(logPath); if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); fs.appendFileSync(logPath, JSON.stringify(entry) + "\n", "utf-8"); } catch (e: any) { console.error(`[eft] Log err: ${e.message}`); } } function loadHistory(logPath: string) { try { if (!fs.existsSync(logPath)) return; const lines = fs.readFileSync(logPath, "utf-8").split("\n").filter(Boolean); history = lines.map(l => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean); console.log(`[eft] Loaded ${history.length} entries from log`); } catch {} } ``` ```typescript latestResult = entry; history.push(entry); analysisCount++; appendLog(logPath, entry); ``` ### Technical Analysis Every analyzed response is appended as plaintext JSON to a persistent JSONL file. Records contain complete sentence text and related metadata. The implementation has no age-based expiration, maximum file size, record limit, rotation policy, deletion mechanism, or explicit restrictive file mode. At startup, the entire log is read synchronously and loaded into the global `history` array. Although the HTTP history response returns only 50 entries, the underlying file and in-memory array remain unbounded. Persistent storage supports the documented dashboard history function, but indefinite retention of raw response content is not necessary to provide a recent-history dashboard and violates data-minimization principles. ### Attack Path **Confidentiality path:** 1. The plugin continuously appends agent response records to `eft_log.jsonl`. 2. Sensitive records remain present indefinitely unless an operator manually removes the file. 3. A local user, c ...[truncated 1016 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to retaining only derived metrics, not raw sentence text. 2. Implement configurable maximum record count, file size, and retention duration. 3. Rotate and securely delete expired log files. 4. Cap the in-memory history array independently of the on-disk retention policy. 5. Load only the required recent records rather than reading the entire file at startup. 6. Replace synchronous filesystem operations with bounded asynchronous operations where practical. 7. Create log files with owner-only permissions, such as mode `0600`, and directories with mode `0700`. 8. Provide documented deletion and data-export controls. 9. Add optional encryption at rest when raw text retention is explicitly enabled. 10. Enforce request and response size limits to reduce storage-exhaustion risk. ]]>

other

Note

• Location: eft_dashboard.html:8
• Finding: Dashboard Loads an External Google Fonts Resource<![CDATA[ ## Vulnerability Details **File Location**: `eft_dashboard.html`, line 8 **Vulnerability Type**: External resource privacy exposure **Risk Level**: Low ### Vulnerable Code ```html @import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@300;400;500;600&family=Inter:wght@300;400;500;600;700&display=swap'); ``` ### Technical Analysis Opening the local EFT dashboard causes the browser to request a stylesheet from `fonts.googleapis.com`. Google Fonts may then cause additional font-resource requests. These requests expose ordinary browser connection metadata, including the visitor's IP address, request headers, and potentially a referring URL depending on browser policy. The dashboard's JavaScript `fetch()` requests otherwise target same-origin `/eft/api/history` or the local fallback `http://localhost:8889/api/history`; no code was found that intentionally sends captured response records to an external host. Therefore, this finding is limited to dashboard visitor metadata and third-party resource trust, not direct exfiltration of analyzed agent text. ### Attack Path 1. An operator opens the EFT dashboard in a browser. 2. The browser processes the external CSS `@import`. 3. A request is sent to Google Fonts outside the local EFT environment. 4. The external service receives network and browser request metadata. 5. If the external resource or delivery path is compromised, externally supplied CSS becomes part of the dashboard's rendering context. ### Impact Assessment The primary impact is limited privacy leakage concerning dashboard access and reliance on an unnecessary external service. No evidence shows that response history, credentials, or analysis data are included in the Google Fonts request. The issue does not provide host privileges or direct access to the local API. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle required font files with the Skill and serve them from the same trusted origin. 2. Alternatively, use system font stacks and remove the external import. 3. Add a restrictive Content Security Policy, for example limiting `default-src` to `'self'` and allowing only explicitly required resource types. 4. Set `Referrer-Policy: no-referrer` or another appropriately restrictive policy. 5. Document any unavoidable external requests and obtain operator consent before enabling them. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (27)

Hidden Instructions

High

• Category: Prompt Injection

Content

# EngineMind EFT - Scientific Evidence & Market Research
## Emotional Framework Translator: Research Compilation

> **Compiled:** February 2026

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: A skill that intercepts and analyzes every AI agent response materially affects privacy and data handling, yet the description does not prominently warn users about this behavior. Because model responses may contain secrets, personal data, or proprietary content, silent interception significantly raises the risk of unauthorized exposure or retention.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Spawning a Python interpreter is not inherently malicious, but it introduces a powerful execution boundary that depends on local interpreter and module resolution. Here the plugin executes code from a user-home Desktop path and inherits the full process environment, so a tampered script or module in that location could run arbitrary code with the host application's privileges.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The plugin stores and serves a rich record of agent outputs, sentence analyses, text previews, timestamps, token usage, session keys, and other metadata as a built-in memory/history feature. This creates a durable sensitive-data repository and direct disclosure channel that is broader than needed for emotion analysis and materially raises privacy, confidentiality, and local attack-surface risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The plugin exposes unauthenticated HTTP endpoints that return the latest analysis, recent history, and allow arbitrary ad hoc analysis requests. Because the history includes response-derived content and session/process metadata and CORS is set to '*', any reachable local or proxied web origin may be able to read sensitive data or drive analysis without user consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly states that EFT 'intercepts every response an AI agent produces' and later describes capture of text, model, tokens, latency, tool calls, plus JSONL logging and dashboard display. That is privacy-sensitive monitoring behavior, and the absence of a prominent warning, consent guidance, retention notice, and scoping controls creates a real risk of unintended collection and persistence of secrets, personal data, and regulated content.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

## Architecture <a name="architecture"></a>

```
┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

## Architecture <a name="architecture"></a>

```
┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘
                      │
                      â–¼
┌─────────────────────────────────────────────────────────────┐

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘
                      │
                      â–¼
┌─────────────────────────────────────────────────────────────┐

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘
                      │
                      â–¼
┌─────────────────────────────────────────────────────────────┐

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

┌─────────────────────────────────────────────────────────────┐
│                    AI Agent Response                         │
│  "The backtest shows a Sharpe ratio of 2.3 with maximum..." │
└─────────────────────┬───────────────────────────────────────┘
                      │
                      â–¼
┌─────────────────────────────────────────────────────────────┐

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

└────┬─────┘ └────┬─────┘ └────┬─────┘
        │             │             │
        â–¼             â–¼             â–¼
   ┌──────────────────────────────────────┐
   │         EmotionMapper                 │
   │  phi, NC, MA, CL, arousal, dims     │
   │  → Calibrated Rules → 10 Emotions    │

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

External Transmission

Medium

• Category: Data Exfiltration

Content

Analyze arbitrary text.

```bash
curl -X POST http://localhost:18789/eft/api/analyze \
  -H "Content-Type: application/json" \
  -d '{"text": "Your text to analyze here"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

| Tool | Type | Limitation vs. EFT |
|---|---|---|
| **VADER** (Hutto & Gilbert) | Lexicon-based sentiment | Positive/negative/neutral only; no complex emotions |
| **TextBlob** | Pattern-based polarity | Simplistic; no emotional granularity |
| **Hugging Face Emotion Pipelines** | Transformer-based classification | Standard 6-8 emotion classes; no narrative arc or consciousness metrics |
| **IBM Watson Tone Analyzer** (deprecated) | API-based tone detection | Discontinued; was limited to 7 tones |
| **Amazon Comprehend** | Cloud sentiment API | 4-class sentiment only (pos/neg/neutral/mixed) |

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares runtime requirements and setup steps that enable code execution and likely environment access, but it does not declare a corresponding tool scope or permission boundary. That mismatch makes the skill's capabilities less transparent and can lead users or hosting systems to activate it without understanding that it can process data through local components and plugins.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description is written broadly enough to apply to "any AI model" and implies pervasive integration, which can cause the skill to activate in many unrelated contexts. Over-broad activation increases the chance of unnecessary interception and analysis of sensitive model outputs that the user did not intend to route through this skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states it hooks into every AI agent response, but it provides no limiting conditions or precise invocation guardrails. In practice, this can turn the skill into a passive interceptor for broad amounts of conversational data, creating privacy, consent, and data-minimization risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The UI explicitly states that the EFT hook captures each agent response automatically, but it provides no meaningful notice, consent flow, or privacy explanation about what content is collected, retained, or displayed. In a tool that monitors model outputs, this can expose sensitive prompts, responses, or proprietary data to users who may not realize monitoring is active.

Internal Network Request

Medium

• Category: Server-Side Request Forgery

Content

// Try gateway API first, fallback to standalone
    let url = "/eft/api/history";
    let r = await fetch(url).catch(()=>null);
    if(!r||!r.ok) { r = await fetch("http://localhost:8889/api/history").catch(()=>null); }
    if(!r||!r.ok){
      // Try loading from log file via standalone server
      document.getElementById('statPill').textContent='API unavailable';

• Confidence: 70% confidence
• Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The code inspects environment variables such as USERPROFILE and HOME to locate executables and log files under the user's desktop. For a skill described only as emotion analysis, accessing host environment configuration and user filesystem locations is an additional host-integration capability not justified by the manifest description alone.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The plugin forwards agent response text to an external Python process for analysis, which is a cross-component data transfer not visible to end users. While local, it still increases exposure because the child process, imported modules, and any errors or future modifications could access or mishandle sensitive response data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The plugin persists analyzed outputs and related metadata to disk, which expands its behavior from transient emotion analysis into durable collection of model responses. In this context the logged entries include text previews, sentence-level analysis, and process/session metadata, creating a privacy and data-retention risk if the host is multi-user, compromised, or the log is later exposed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Assistant response content and derived emotional analysis are appended to a local JSONL log without any evident consent, disclosure, or retention control. Even the stored preview and sentence-level outputs can contain secrets, personal data, or sensitive business content produced by the agent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The HTTP endpoints expose latest and historical analysis results, including content-derived fields, without any user-facing warning or access control. In context this is more dangerous because the skill processes AI responses that may contain confidential prompts, outputs, or identifiers, and then republishes them over a simple API.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: plugin/index.ts:41