mar-emotion-state

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:05 AM UTC
• Version: 1.0.0

Overview

This skill is an emotion-tracking hook, but it sends conversation text to external classifiers, injects externally derived text into prompts, and reads sibling agents' state with limited disclosure.

Review this skill carefully before installing. It can send raw conversation messages to a configured classifier or SkillBoss, store inferred emotional history across sessions, place those in future prompts, and read emotion state from sibling agents. Only use it where those data flows are acceptable and where classifier endpoints and stored state are trusted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: hooks/emotion-state/handler.ts:268

Finding

Unredacted Conversation Content Transmitted to External Classifiers

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: hooks/emotion-state/handler.ts:322

Finding

Untrusted Classifier Output Injected into the System Prompt

Content

View full analysis

", " "]; for (const entry of userEntries) { lines.push(` ${formatEntry(entry, options.timeZone)}`); } if (userTrend) lines.push(` Trend (last ${options.trendWindowHours}h): mostly ${userTrend}.`); lines.push(" "); lines.push(" "); for (const entry of agentEntries) { lines.push(` ${formatEntry(entry, options.timeZone)}`); } if (agentTrend) lines.push(` Trend (last ${options.trendWindowHours}h): mostly ${agentTrend}.`); lines.push(" "); if (options.otherAgents.length > 0) { lines.push(" "); for ...[truncated 3390 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: hooks/emotion-state/handler.ts:427

Finding

Cross-Agent Emotion State Read Without an Authorization Boundary

Content

View full analysis

(filePath); const latest = state?.agents?.[entry.name]?.latest || state?.users?.[entry.name]?.latest; if (latest) results.push({ id: entry.name, latest }); if (results.length >= maxAgents) break; } } catch (err) { console.error("[emotion-state] Failed to load other agents:", err); return []; } return results; } ``` ```ts if (options.otherAgents.length > 0) { lines.push(" "); for (const other of options.otherAgents) { lines.push( ` ${other.id} — ${formatEntry(other.latest, options.timeZone)}`, ); } lines.push(" "); } ``` ```ts const otherAgents = await loadOtherAgents( getOtherAgentsRoot(agentDir), agentId, DEFAULTS.stateFileName, maxOtherAgents, ); ``` ### Technical Analysis The hook derives the shared agents root by traversing two directory levels above the current agent directory. It then enumerates sibling agent directories and reads their emotion-state files. No authorization check verifies that the current session may access another agent's state. There is also no user, tenant, workspace, or ...[truncated 1718 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose understates materially sensitive behavior: persistent local storage, historical/session data access, external API transmission, and cross-agent state discovery. That mismatch is dangerous because operators may enable the skill for harmless-seeming prompt augmentation while unknowingly granting surveillance-like capabilities across sessions and potentially across agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code forwards conversation content to external services without any visible user-facing disclosure, confirmation, or policy gate. Because messages may contain secrets, personal data, or system prompts, silent transmission to third parties materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · hooks/emotion-state/handler.ts (reported line 361)May include surrounding context.

ts

.sort((a, b) => (a.ts < b.ts ? -1 : a.ts > b.ts ? 1 : 0));
  const toRemove = sorted.slice(0, keys.length - maxUsers);
  for (const { key } of toRemove) {
    delete state.users[key];
  }
}

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

loadOtherAgents enumerates sibling agent directories and reads their emotion state, then later includes that data in the injected bootstrap block. This crosses agent isolation boundaries and shares private state unrelated to the current session, which can leak sensitive context and influence the current agent with information it should not have.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The hook does more than passive emotion tracking: it injects generated natural-language content into the agent bootstrap prompt via context.bootstrapFiles. That creates a prompt-side influence channel where persisted or externally derived emotion summaries can steer model behavior beyond the stated purpose, and the skill description explicitly mentions prompt injection, increasing concern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation declares no permissions or allowed tool scope even though the described behavior clearly involves environment variables and outbound network access. This weakens transparency and consent controls, making it easier for a user or operator to install a skill without understanding that it can access secrets and transmit data externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Persisting user-derived emotion state across sessions and reinjecting it into the system prompt affects privacy, profiling, and downstream model behavior, yet the skill description does not present this as a prominent warning. Users may not realize inferred emotional metadata can continue to influence future interactions long after the original conversation ends.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The documentation identifies a third-party API endpoint used for LLM-based emotion detection, confirming external transmission capability. In this skill context, that is sensitive because the transmitted content is derived from user interactions and feeds a persistent prompt-injection mechanism, increasing privacy and trust risks even if the endpoint itself is legitimate.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

}

text

The emotion classification uses SkillBoss API Hub (`https://api.heybossai.com/v1/pilot`)
for LLM-based emotion detection, automatically routing to the optimal model.

## Notes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends user-derived data to a remote emotion-classification API but does not provide a strong warning or consent-oriented disclosure near the feature description. Even if raw text is not stored locally, inferred or derived user data being transmitted off-box creates privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The hook is designed to retain emotional summaries and inject them into the system prompt during bootstrap. Persisting and replaying emotional state in privileged prompt context can expose sensitive user information to the model and to downstream tooling or logs, expanding access beyond the original interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that emotion classification may send user/agent emotional content to an external endpoint or to a third-party API hub, but it does not present any explicit privacy warning, consent requirement, or data-handling limitation. Because emotion data can reveal sensitive mental state and personal context, transmitting it off-box materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The file explicitly documents use of an external API endpoint for emotion classification. While external services are not inherently malicious, sending conversation-derived emotion data to a remote service creates a real data exfiltration surface, especially given the sensitivity of inferred emotional state.

Content

Scanner excerpt · hooks/emotion-state/HOOK.md (reported line 18)May include surrounding context.

md

config, or export them in the environment.

- `EMOTION_CLASSIFIER_URL`: Optional HTTP endpoint for classification.
- `SKILLBOSS_API_KEY`: Required if no classifier URL. The hook calls SkillBoss API Hub (`https://api.heybossai.com/v1/pilot`) for emotion classification, automatically routing to the optimal model.
- `EMOTION_CONFIDENCE_MIN`: Default `0.35`.
- `EMOTION_HISTORY_SIZE`: Default `100`.
- `EMOTION_HALF_LIFE_HOURS`: Default `12`.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example shows personal statements such as frustration due to deployment delays being replayed nearly verbatim inside an injected prompt block. Verbatim replay preserves sensitive context and can leak private details to the model, other agents, logs, or any component that can inspect prompts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill transmits raw conversation text to either a configurable external endpoint or a third-party API for classification. Even if done for emotion analysis, sending message content off-box without strict minimization, consent, and destination controls creates an unnecessary data exposure path for potentially sensitive prompts and responses.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The hardcoded https://api.heybossai.com/ destination confirms that content leaves the local trust boundary for external processing. Combined with the skill's access to session messages, this is a real privacy and security concern rather than a merely theoretical network call.

Content

Scanner excerpt · hooks/emotion-state/handler.ts (reported line 287)May include surrounding context.

ts

const systemPrompt =
    "You are an emotion classifier. Return only JSON with keys: label, intensity, reason, confidence. " +
    "label is a short emotion word, intensity is low|medium|high, reason is a short clause, confidence is 0..1.";
  const response = await fetch("https://api.heybossai.com/v1/pilot", {
    method: "POST",
    headers: {
      "content-type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The hardcoded https://api.heybossai.com/ destination confirms that content leaves the local trust boundary for external processing. Combined with the skill's access to session messages, this is a real privacy and security concern rather than a merely theoretical network call.

Content

Scanner excerpt · hooks/emotion-state/handler.ts (reported line 287)May include surrounding context.

ts

const systemPrompt =
    "You are an emotion classifier. Return only JSON with keys: label, intensity, reason, confidence. " +
    "label is a short emotion word, intensity is low|medium|high, reason is a short clause, confidence is 0..1.";
  const response = await fetch("https://api.heybossai.com/v1/pilot", {
    method: "POST",
    headers: {
      "content-type": "application/json",

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill persists emotional interpretations tied to users and agents, then converts them into plain-language summaries injected into bootstrap context. This creates a semantic leakage channel where prior sensitive interactions can be resurfaced to the model or downstream tooling, increasing the chance of unintended disclosure or biased behavior.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code reads other agents' latest emotion entries and includes them in the <others> section of the bootstrap text. That semantically shares private agent context across boundaries and can leak information about unrelated sessions, users, or workflows to the current agent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Timestamp formatting is hardcoded to use the "en-CA" locale regardless of user preference or environment. This is a natural-language/locale policy concern because it imposes a specific locale format without offering choice or documenting why that locale is required.

Content

No source excerpt is available for this finding.