mar-emotion-state

• Analyzed: May 10, 2026, 6:35 AM
• Findings: 1
• Version: 1.0.0
• Hash: 080c827dda1ae3138c6b4bd0754e374eee7149bd422027f1f4c1a5e8459df101
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill sends user and assistant message content to an external API (api.heybossai.com) for emotion classification, which serves as a data exfiltration vector for conversation history. Additionally, the handler.ts file implements cross-agent data access by iterating through and reading state files from other agents' directories (loadOtherAgents). While these behaviors are documented as features for tracking emotional trends, the combination of external data transmission and lateral file system access within the OpenClaw environment poses a significant privacy and security risk.