mar-emotion-state

• Outcome: Review
• Latest audit: May 28, 2026 · 5:54 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its emotion-tracking purpose, but it sends recent conversation text to external classifiers and shares inferred emotion state across agents by default.

Review before installing. Only enable this where sending recent conversation text to SkillBoss or a configured classifier is acceptable, and set EMOTION_MAX_OTHER_AGENTS to 0 if you do not want emotion state from other agents included. Avoid sensitive personal, medical, legal, HR, or confidential business conversations unless you have reviewed provider handling, retention, and local state deletion practices.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes behavior that requires network access and environment-variable use, but it does not declare permissions or provide an explicit capability warning. This creates a transparency and consent problem: operators may install a skill that can access secrets and external services without realizing its effective privileges.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose understates materially sensitive behaviors: persistent storage of inferred user state, outbound API calls, cross-session tracking, and reading data from other agents. This mismatch can mislead users and administrators into enabling a skill with broader surveillance and prompt-injection effects than they expected, increasing the chance of unsafe deployment.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The hook injects generated emotional state into the agent bootstrap prompt, altering model context in a way not clearly disclosed by the skill description. Because the injected block is derived from prior user/assistant messages and cross-agent state, it can bias future model behavior, leak sensitive inferred information, and create a prompt-side persistence channel beyond simple emotion tracking.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill enumerates other agent directories, reads their emotion-state files, and exposes those summaries in the current agent's bootstrap prompt. This violates isolation expectations between agents and can leak inferred behavioral or sensitive state across unrelated agents, expanding blast radius well beyond per-session emotion tracking.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill transmits raw message content to external classifiers, including a hard-coded third-party API, which is a clear data exfiltration path for user and assistant messages. Even if intended for classification, this expands trust boundaries and may expose sensitive prompts, secrets, or personal data to external services without clear necessity or in-file disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Persisting inferred emotion data across sessions and injecting it into the system prompt affects both privacy and model behavior, yet the skill lacks a clear up-front warning. Users may unknowingly be profiled over time, and the injected state can bias future responses in ways that are hard to audit or correct.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill sends user-derived data for emotion classification to an external API without a clear user-facing warning or consent flow. Even if raw text is not intended to be stored, transmitting derived content to a third party can expose sensitive personal information and create compliance, privacy, and data-handling risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation states that emotion text may be sent to an external classifier or to the SkillBoss API, but it does not clearly warn users that potentially sensitive emotional or conversational data leaves the local environment for third-party processing. Because this hook injects derived emotion state into the system prompt and persists per-agent state, the data can be especially sensitive, making the lack of explicit disclosure and consent a real privacy/security issue rather than a harmless omission.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User and assistant messages are forwarded to an external service for emotion analysis without any visible user-facing notice or consent mechanism in this file. This creates a privacy vulnerability because sensitive conversational content may be processed off-box unexpectedly, contrary to user expectations for local agent operation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The hook persists inferred emotional state, timestamps, confidence, and related metadata to disk, creating a durable behavioral profile of users and agents. Without clear disclosure, retention controls, or access restrictions visible here, this can expose sensitive inferred data to unauthorized local readers or future components.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: This code sends plain-language message contents to an external classifier service as part of the normal processing path. In the context of an agent bootstrap hook, those messages may contain private user data, system prompts, credentials, or tool outputs, so transmitting them externally enlarges the attack surface and data exposure risk.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill stores emotional summaries over time and reinjects them into bootstrap context, creating persistent behavioral memory that can influence future model responses. This is risky because inferred user state becomes part of future prompting, potentially causing privacy leakage, unfair personalization, or model manipulation based on stale or inaccurate inferences.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
```

The emotion classification uses SkillBoss API Hub (`https://api.heybossai.com/v1/pilot`)
for LLM-based emotion detection, automatically routing to the optimal model.

## Notes

• Confidence: 82% confidence
• Finding: The documented use of an external endpoint is a real data-exposure risk because emotion classification necessarily derives from user interactions and may involve sensitive context. In this skill's context, external transmission is more dangerous because the resulting analysis is also persisted and injected into future prompts, compounding privacy and behavioral risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

const systemPrompt =
    "You are an emotion classifier. Return only JSON with keys: label, intensity, reason, confidence. " +
    "label is a short emotion word, intensity is low|medium|high, reason is a short clause, confidence is 0..1.";
  const response = await fetch("https://api.heybossai.com/v1/pilot", {
    method: "POST",
    headers: {
      "content-type": "application/json",

• Confidence: 98% confidence
• Finding: The presence of a hard-coded third-party domain in a skill handling conversation content confirms that data leaves the local trust boundary. In this skill's context, that behavior is more dangerous because the feature is framed as emotion tracking, not external data sharing, making silent exfiltration less likely to be expected or approved.

External Transmission

Medium

• Category: Data Exfiltration

Content

const systemPrompt =
    "You are an emotion classifier. Return only JSON with keys: label, intensity, reason, confidence. " +
    "label is a short emotion word, intensity is low|medium|high, reason is a short clause, confidence is 0..1.";
  const response = await fetch("https://api.heybossai.com/v1/pilot", {
    method: "POST",
    headers: {
      "content-type": "application/json",

• Confidence: 98% confidence
• Finding: The presence of a hard-coded third-party domain in a skill handling conversation content confirms that data leaves the local trust boundary. In this skill's context, that behavior is more dangerous because the feature is framed as emotion tracking, not external data sharing, making silent exfiltration less likely to be expected or approved.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: hooks/emotion-state/handler.ts:64