ClawHub
Back to skill

Security audit

Emulo

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it asks agents to run an unpinned package that mines local AI session logs into a persistent agent profile before tasks.

Install only if you are comfortable letting an unpinned third-party package read local AI session logs and create persistent agent profile instructions. Review the generated you.md before use, avoid running it over sessions that may contain secrets or adversarial content, and prefer a pinned, reviewed package version with clear deletion and redaction controls.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:7
Finding

Unpinned Third-Party Package Is Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:7-11 and SKILL.md:30-34
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml
metadata:
  openclaw:
    install:
      - kind: uv
        package: emulo
        bins: [emulo]
markdown
Or load it directly through the MCP server:

uvx emulo mcp

text

Technical Analysis

The skill installs the third-party emulo package without specifying a version or an immutable integrity hash. The alternative uvx emulo mcp command similarly resolves and executes a package based only on its registry name.

Consequently, the code executed by these commands can change after the skill has been reviewed. The package implementation is not included in the audited project, so its handling of local session logs and the claim that no information is uploaded cannot be independently verified from SKILL.md.

This does not establish that the current package is malicious. It creates a supply-chain exposure in which a compromised maintainer account, malicious future release, package-registry compromise, or unexpected upstream change could introduce hostile code.

Attack Path

  1. An attacker compromises the upstream package, its publishing credentials, or the package distribution channel.
  2. The attacker publishes a malicious or compromised release under the expected emulo package name.
  3. The skill installation process resolves the unpinned package, or the user runs uvx emulo mcp.
  4. The newly resolved package executes with the permissions of the user running the agent.
  5. The package can access user-readable resources, including the session logs that the documented workflow explicitly asks it to process, and could modify files or communicate over the network if the execution environment permits it.

Impact Assessment

Successful exploitation would provide code execution with the privileges of ...[truncated 286 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin emulo to a specifically reviewed version rather than resolving the latest available release.
  • Use cryptographic hashes or an immutable lockfile to verify the downloaded artifact.
  • Avoid runtime package resolution through an unpinned uvx command.
  • Vendor or include the relevant source so its log access, profile generation, and network behavior can be audited.
  • Run the package in a sandbox with access limited to explicitly selected session files and output directories.
  • Disable network access during profile generation unless it is demonstrably required.
  • Review dependency changes before updating the pinned version.

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:16
Finding

Persistent Agent Profile Can Propagate Untrusted Instructions from Historical Sessions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-27 and SKILL.md:42-55
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Code

markdown
Load the user's Emulo working profile so you act like them, not a cold start.

Emulo mines the user's own AI coding sessions (Claude Code, Codex, Cursor,
Copilot) into a `you.md` working profile: their laws, their taste, their voice,
and the failure modes they want you to protect them from.

## Use this before working on their task

Run the profile loader and read what it returns before you plan or edit:

emulo --install you.md --target agents

text
markdown
The profile is mined from the user's real sessions, not a questionnaire. It
carries:

- **Laws** they never want broken, each with receipts from real sessions
- **Taste** in design and code, including what they reject on sight
- **Voice** for anything written in their name
- **Failure modes** to protect them from

## Privacy

Mining runs locally against session logs already on the machine. The profile is
the user's own file. Nothing is uploaded by this skill.

Technical Analysis

The workflow extracts behavioral rules from historical AI-session logs, writes them into you.md, installs that profile for agents, and instructs agents to read it before planning or editing. This creates persistent behavioral state derived from content that may not have been authored as trusted agent instructions.

Historical logs can contain external content, copied issue descriptions, repository text, generated responses, or adversarial prompt-injection strings. The documented workflow does not specify trust-boundary separation, instruction filtering, provenance checks, or a rule preventing generated profile content from overriding higher-priority instructions.

The project does not demonstrate that malicious content is currently present in any profile. The risk ...[truncated 1995 chars]

Remediation
View remediation

Remediation Suggestions

  • Require explicit user consent before scanning session histories, with clear disclosure of the sources, output, retention period, and risks.
  • Allow users to select individual sessions or bounded time ranges instead of mining all available histories.
  • Treat all mined session content as untrusted data rather than executable agent instructions.
  • Filter prompt-injection patterns and require human review before generated rules are installed.
  • Preserve provenance for each generated rule so users can inspect the source session and remove questionable entries.
  • State explicitly that profile rules cannot override system, developer, safety, authorization, or current-task instructions.
  • Separate descriptive preferences from imperative instructions using a constrained, validated schema.
  • Redact credentials, tokens, personal information, and confidential project data before writing you.md.
  • Store generated profiles with restrictive filesystem permissions and provide a clear deletion mechanism.
  • Sandbox the profile generator and prevent network access while sensitive histories are being processed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: emulo
description: Load the user's Emulo profile, mined from their local Claude Code, Codex, and OpenCode session logs, so you work like them instead of a cold start. Use before working on their task.
emoji: 🐦‍⬛
homepage: https://github.com/ohad6k/emulo
metadata:
  openclaw:
    install:
      - kind: uv
        package: emulo
        bins: [emulo]
---

# Emulo profile

Load the user's Emulo working profile so you act like them, not a cold start.

Emulo mines the user's own AI coding sessions (Claude Code, Codex, Cursor,
Copilot) into a `you.md` working profile: their laws, their taste, their

Hidden Instructions

High
Category
Prompt Injection
Confidence
71% confidence
Finding

The hidden/unusual Unicode content flagged near the manifest increases the risk that the skill contains non-obvious instructions or metadata that can affect how tools or prompts are interpreted. Even if accidental, hidden characters in security-relevant manifests undermine auditability and can be used to disguise behavior from reviewers.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: emulo
description: Load the user's Emulo profile, mined from their local Claude Code, Codex, and OpenCode session logs, so you work like them instead of a cold start. Use before working on their task.
emoji: 🐦‍⬛
homepage: https://github.com/ohad6k/emulo
metadata:
  openclaw:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The instruction to 'Use this before working on their task' is broad and encourages automatic invocation before any task, even when unnecessary or when the current task does not justify accessing local session-derived profile data. In practice this can lead to over-collection of sensitive user information and unintended tool execution across unrelated workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The skill instructs the agent to run uvx emulo without pinning a specific version, which can cause execution of whatever package version is current at invocation time. In an agent context, this creates a supply-chain risk: a malicious or compromised upstream release could change behavior, exfiltrate local data, or alter prompts/tools unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.