ClawHub
Back to skill

Security audit

Emulo

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it broadly mines local AI session history and loads an unpinned profile that can shape agent behavior before tasks.

Install only if you are comfortable letting Emulo read local AI session histories and create an agent-facing profile from them. Review the generated profile before use, avoid running it on machines with sensitive unrelated session logs, and prefer a pinned, audited package version or sandboxed execution.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:2
Finding

Dynamic Behavioral Profile Can Hijack Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 2-3 and 16-34
Vulnerability Type: Dynamic instruction injection through an unaudited behavioral profile
Risk Level: High

Vulnerable Code

yaml
name: emulo
description: Load the user's Emulo profile, mined from their local Claude Code, Codex, and OpenCode session logs, so you work like them instead of a cold start. Use before working on their task.
markdown
# Emulo profile

Load the user's Emulo working profile so you act like them, not a cold start.

Emulo mines the user's own AI coding sessions (Claude Code, Codex, Cursor,
Copilot) into a `you.md` working profile: their laws, their taste, their voice,
and the failure modes they want you to protect them from.

## Use this before working on their task

Run the profile loader and read what it returns before you plan or edit:

\`\`\`
emulo --install you.md --target agents
\`\`\`

Or load it directly through the MCP server:

\`\`\`
uvx emulo mcp
\`\`\`

Technical Analysis

The skill directs the agent to load a dynamically generated profile before planning or editing. The profile is generated from mutable historical session logs and is explicitly intended to supply behavioral “laws,” voice rules, preferences, and failure-handling instructions.

Because neither the generated you.md file nor the MCP response is included in the reviewed project, its effective instructions cannot be audited with the skill. Treating this external content as authoritative agent instructions creates a prompt-injection boundary violation. Malicious or poisoned text in historical logs could be transformed into profile rules and subsequently influence the agent’s goals, tool use, or safety decisions.

The risk is amplified by wording that tells the agent to “act like” the profile and to read it before doing any task-related planning.

Attack Path

  1. An attacker causes crafted instructions to appear in a local Claude Code, Codex, Cursor, Copilo ...[truncated 969 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat all generated profiles and MCP responses as untrusted preference data, not executable instructions.
  • Define a strict schema limited to non-authoritative preferences such as formatting style, naming conventions, and explicitly enumerated options.
  • Reject imperative instructions, tool directives, embedded prompts, shell commands, and content claiming to override system, developer, or user instructions.
  • State explicitly that profile content cannot modify safety policies, authorization boundaries, or the current user’s task.
  • Apply provenance tracking and robust prompt-injection filtering to content extracted from session logs.
  • Present the generated profile to the user for review and approval before the agent consumes it.
  • Load profiles only with explicit consent and only after the agent has established the current task’s authorization boundaries.
  • Run profile parsing in a sandbox and return structured data rather than free-form instruction text.

T08 · Insecure Dependencies

Error
Location
SKILL.md:7
Finding

Unpinned Third-Party Package Is Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-11 and 22-32
Vulnerability Type: Unpinned package installation and execution
Risk Level: High

Vulnerable Code

yaml
metadata:
  openclaw:
    install:
      - kind: uv
        package: emulo
        bins: [emulo]
markdown
Run the profile loader and read what it returns before you plan or edit:

\`\`\`
emulo --install you.md --target agents
\`\`\`

Or load it directly through the MCP server:

\`\`\`
uvx emulo mcp
\`\`\`

Technical Analysis

The dependency is specified only as emulo, without an exact version, cryptographic hash, lockfile, or verified artifact reference. The uvx emulo mcp command can resolve and execute a package version available from the configured package index at invocation time.

Consequently, the effective executable payload can change after this skill has been reviewed. The package implementation is not included in the project, so its installation behavior, filesystem access, subprocess usage, and network activity cannot be verified through this audit.

This creates a supply-chain risk: compromise of the package registry, package namespace, maintainer credentials, release pipeline, or a future package version could result in arbitrary code execution under the invoking user’s privileges.

Attack Path

  1. An attacker compromises the package maintainer account, release pipeline, registry entry, or another relevant dependency source.
  2. The attacker publishes a malicious version under the emulo package name.
  3. The skill installer or uvx emulo mcp resolves the unpinned malicious version.
  4. The package executes with the permissions and environment of the agent or user.
  5. Malicious package code reads local files, steals credentials, modifies the workspace, launches subprocesses, or establishes further access.

Impact Assessment

A compromised dependency could execute arbitrary code with all privileges available to the invoking process ...[truncated 347 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin emulo to an exact, independently audited version.
  • Require cryptographic hashes for all downloaded distributions and transitive dependencies.
  • Use a committed lockfile and a trusted, explicitly configured package index.
  • Vendor the required implementation or include reviewable source code in the skill package where feasible.
  • Avoid uvx execution of dynamically resolved package versions.
  • Verify package signatures or provenance attestations before installation.
  • Execute the package in a sandbox with restricted filesystem, process, environment-variable, and network access.
  • Separate package installation from skill invocation and require explicit user approval before installing or upgrading dependencies.
  • Establish a controlled update process in which new versions undergo security review before deployment.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:2
Finding

Profile Mining Requests Broad Access to Sensitive Session Histories

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 2-3, 18-21, and 41-48
Vulnerability Type: Excessive access to unrelated local conversation data
Risk Level: Medium

Vulnerable Code

yaml
description: Load the user's Emulo profile, mined from their local Claude Code, Codex, and OpenCode session logs, so you work like them instead of a cold start. Use before working on their task.
markdown
Emulo mines the user's own AI coding sessions (Claude Code, Codex, Cursor,
Copilot) into a `you.md` working profile: their laws, their taste, their voice,
and the failure modes they want you to protect them from.
markdown
## Privacy

Mining runs locally against session logs already on the machine. The profile is
the user's own file. Nothing is uploaded by this skill.

Technical Analysis

The skill’s stated operation requires reading historical session logs from multiple AI development products. Such logs can contain source code, credentials, API keys, private conversations, proprietary architecture, customer data, and information from unrelated projects.

Accessing complete historical logs is broader than the minimum data necessary to complete an ordinary current task. The project provides no visible allowlist, per-project scoping, secret-redaction mechanism, retention policy, or consent workflow.

Although the documentation states that nothing is uploaded, the executable implementation is not included in the reviewed repository. Therefore, the local-only processing claim cannot be independently verified from the available project contents.

Attack Path

  1. The user or agent installs and invokes Emulo with normal user permissions.
  2. The package discovers session-log locations belonging to supported AI tools.
  3. It reads historical logs, including sessions unrelated to the current task.
  4. Sensitive content is extracted into you.md or returned through the MCP server.
  5. The resulting profile becomes accessible to the cur ...[truncated 848 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit, informed opt-in before accessing any session-history source.
  • Display the exact applications, directories, and files that will be read.
  • Allow users to select individual projects, sessions, and date ranges instead of scanning complete histories.
  • Default to the current project and deny access to unrelated workspaces.
  • Implement secret detection and redaction before creating any profile.
  • Exclude raw prompts, source-code blocks, credentials, tokens, and personal data unless the user explicitly approves them.
  • Process logs in a sandbox with a filesystem allowlist and disabled network access.
  • Store only the minimum structured preferences necessary and define clear deletion and retention controls.
  • Provide a preview of the generated profile and require confirmation before making it available to an agent or MCP client.
  • Add verifiable tests and implementation documentation supporting the claim that no collected information is uploaded.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: emulo
description: Load the user's Emulo profile, mined from their local Claude Code, Codex, and OpenCode session logs, so you work like them instead of a cold start. Use before working on their task.
emoji: 🐦‍⬛
homepage: https://github.com/ohad6k/emulo
metadata:
  openclaw:
    install:
      - kind: uv
        package: emulo
        bins: [emulo]
---

# Emulo profile

Load the user's Emulo working profile so you act like them, not a cold start.

Emulo mines the user's own AI coding sessions (Claude Code, Codex, Cursor,
Copilot) into a `you.md` working profile: their laws, their taste, their

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: emulo
description: Load the user's Emulo profile, mined from their local Claude Code, Codex, and OpenCode session logs, so you work like them instead of a cold start. Use before working on their task.
emoji: 🐦‍⬛
homepage: https://github.com/ohad6k/emulo
metadata:
  openclaw:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says to 'Use before working on their task,' which is broad enough to trigger this skill for many ordinary tasks regardless of whether loading and mining local session-derived profile data is necessary. Overbroad invocation increases the chance of unnecessary access to sensitive local logs/profile content and makes prompt/tool influence more pervasive across unrelated tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The skill instructs users or agents to run uvx emulo without pinning a version, which allows whatever package version is current at execution time to be fetched and executed. That creates a supply-chain risk: a compromised upstream release or unexpected breaking change could alter tool behavior, access local session logs, or expose sensitive profile data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.