Security audit

Thymos — Emotional Engine

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and disclosed, but it creates a persistent mutable channel that can steer an agent's behavior and includes optional daemon, hook, persistence, and Discord messaging flows that need careful review.

Install only if you intentionally want an external emotional-state system to influence agent tone across sessions. Review the daemon source and dependencies first, pin to an immutable reviewed commit, keep the service bound to localhost, avoid putting free-form prompt_injection text into persistent agent instructions, and enable Discord/proactive messaging only with a least-privilege bot token and a test channel.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:7
Finding: Persistent Agent Instruction Injection Through Mutable Emotional State
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: docs/USAGE.en.md:34
Finding: Optional Reboot Persistence for an Externally Retrieved Daemon
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: docs/USAGE.en.md:16
Finding: Mutable Remote Repository Is Downloaded and Executed Without Immutable Pinning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: docs/USAGE.en.md:160
Finding: Discord Bot Token Stored in Plaintext JSON Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (30)

Ssd 1

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README instructs the agent to read a local prompt_injection field from emotional_state.json before every response and apply it to behavior. That creates an explicit semantic prompt-injection channel: any actor able to influence that file, or upstream webhook inputs that eventually populate it, can persistently steer the agent's future behavior outside the normal conversation trust model.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
- All emotional data stored **locally only** (`~/Documents/thymos/data/`) - No data transmitted to external servers - Reset anytime: `rm ~/Documents/thymos/data/*.json` - Discord proactive messaging is opt-in and disabled by default ## Theoretical Foundations

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · docs/USAGE.en.md (reported line 66)May include surrounding context.
bash
# Alive check curl http://localhost:7749/health # Full state (neuromodulators, mood vector, etc.) curl http://localhost:7749/state | python3 -m json.tool

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · docs/USAGE.en.md (reported line 248)May include surrounding context.

10. Reset State

bash
rm ~/Documents/thymos/data/*.json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/USAGE.en.md (reported line 251)May include surrounding context.
10. Reset State

bash
rm ~/Documents/thymos/data/*.json pm2 restart thymos # Agent starts fresh — infant stage, baseline neuromodulators

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · docs/USAGE.md (reported line 66)May include surrounding context.
bash
# 살아있는지 확인 curl http://localhost:7749/health # 현재 기분 + 신경조절물질 전체 상태 curl http://localhost:7749/state | python3 -m json.tool

Ssd 1

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The AGENTS.md guidance explicitly tells the model to read a field named prompt_injection and let it shape behavior. That normalizes externally influenced instructions as an input channel for model behavior, creating a direct prompt-injection pathway where untrusted state can manipulate future responses.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: The documentation includes a direct rm ~/Documents/thymos/data/*.json command that can irreversibly delete application state when copied verbatim. In operational contexts, destructive shell commands in docs are risky because users often execute them without fully understanding the scope, leading to accidental data loss.
Content: Scanner excerpt · docs/USAGE.md (reported line 254)May include surrounding context.
bash
# 감정 상태 초기화 (새로 시작) rm ~/Documents/thymos/data/*.json pm2 restart thymos

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explicitly documents an optional mode where the agent can initiate unprompted outbound messages, but it does not pair that capability with clear user consent, rate limits, scope restrictions, or privacy warnings. In an agent context, autonomous outbound behavior can surprise users, leak inferred internal state, or send unwanted messages to third-party platforms such as Discord.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The prompt example instructs the model to use 'informal close language' as a fixed behavioral output without indicating user preference, locale sensitivity, or opt-in. This is a softer safety issue than direct code execution, but in conversational agents it can override user expectations, create manipulative familiarity, and produce inappropriate tone for professional or vulnerable contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented /state and /prompt endpoints expose full emotional state and prompt-injection data, which may include per-user relationship modeling, behavioral guidance, or other sensitive internal state. Even though this is documentation rather than implementation, presenting these endpoints without any warning about authentication, local-only binding, or data sensitivity normalizes deployment patterns that could leak private agent and user profiling information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The core prompt-injection example again presents informal close language as a predetermined behavior, reinforcing a design that may push the agent toward artificial intimacy without user choice. In this skill's context of persistent relationship and emotional modeling, that behavior is more concerning because it can amplify undue trust or anthropomorphic attachment over time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explicitly documents a proactive messaging feature that uses a Discord bot token and channel ID to let the system initiate outbound messages once emotional state accumulates. Even if presented as optional, the documentation does not clearly warn that enabling it causes autonomous external network activity and message sending, which can surprise operators and create data leakage or unauthorized automation risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The OpenClaw integration instructions describe automatic transmission of incoming messages to /webhook/stimulus and agent responses to /webhook/self-feedback, while also telling users to consume local prompt-injection state before every reply. This creates a continuous data flow and behavior-shaping path without a clear warning about automatic forwarding, privacy implications, or the trust boundary between hooks, local state, and the agent.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SECURITY.md (reported line 16)May include surrounding context.
md
- No telemetry, analytics, or external data reporting of any kind - No credentials, API keys, or environment variables are required for basic operation - No postinstall scripts (`npm install` does not execute arbitrary code) - No elevated privileges (runs as your user account) - No inbound network exposure (port 7749 binds to `localhost` only)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to read a local file and apply a prompt_injection field before every response, effectively creating an untrusted side channel that can override or bias model behavior. Because the file contents are treated as operative instructions without validation, any process or user able to modify that file can steer outputs, weaken safeguards, or inject malicious directives persistently across sessions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/USAGE.en.md (reported line 72)May include surrounding context.
curl http://localhost:7749/state | python3 -m json.tool

LLM-ready prompt injection text

curl http://localhost:7749/prompt

text
**`/health` response:**

External Transmission

Medium

Category: Data Exfiltration
Confidence: 79% confidence
Finding: The self-feedback endpoint explicitly feeds the LLM's own output back into the system state, creating a feedback channel where attacker-influenced model text can persistently shape future behavior. In an agent context, this can amplify prompt injection, behavioral drift, and manipulation over time, especially when outputs are reflected without validation or scoping.
Content: Scanner excerpt · docs/USAGE.en.md (reported line 127)May include surrounding context.
Feed the LLM's own output back into Thymos (damped at 0.3×).

bash
curl -X POST http://localhost:7749/webhook/self-feedback \ -H "Content-Type: application/json" \ -d '{"content":"Got it, I will handle that right away."}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The proactive messaging setup tells users to place a discordToken in config/proactive.json, but the documentation does not warn that this is a sensitive secret requiring careful handling. For markdown files, omission of privacy or system-integrity warnings around credentials is in scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The AGENTS.md snippet directs the agent to use the prompt_injection field to shape tone and to follow the Tone: line's style guidance before each response. This imposes a communication style automatically, without indicating user choice or opt-in, which falls under natural-language policy concerns about forced language/locale behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reset section instructs users to run rm ~/Documents/thymos/data/*.json, which deletes stored state, and then restart the service. Although the command is clear, the markdown does not explicitly warn that this permanently removes local data or emotional/history state before the user runs it.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/USAGE.md (reported line 72)May include surrounding context.
curl http://localhost:7749/state | python3 -m json.tool

LLM에 주입할 프롬프트 텍스트

curl http://localhost:7749/prompt

text
**`/health` 응답 예시:**

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The self-feedback endpoint sends model-generated response content to another service for analysis and state updates. Even though this is local HTTP, it is still a cross-component transmission of potentially sensitive model output, and the docs do not clearly warn about privacy, retention, or logging implications.
Content: Scanner excerpt · docs/USAGE.md (reported line 127)May include surrounding context.
LLM이 생성한 응답을 Thymos에 돌려줍니다 (자기 피드백 루프).

bash
curl -X POST http://localhost:7749/webhook/self-feedback \ -H "Content-Type: application/json" \ -d '{"content":"알겠어, 바로 처리할게. 잠깐만."}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The proactive messaging section instructs users to configure a Discord bot token and channel for automatic outbound messages, but it does not clearly warn that the system may send messages to an external service without a per-message user action. This can surprise operators, leak sensitive internal state or behavior externally, and create unintended communications from the agent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The OpenClaw integration narrative describes forwarding agent messages and responses over local HTTP to Thymos, but does not clearly warn that conversational content will be transmitted and processed outside the primary agent runtime. Even on localhost, this expands the data flow surface and may expose sensitive prompts, responses, or metadata to another service.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.en.md:167

Overview

A.I.G

T01 · Skill Instruction Hijacking

T06 · System Persistence

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

SkillSpector

Ssd 1

Tool Parameter Abuse

External Script Fetching

Memory Manipulation

10. Reset State

Tool Parameter Abuse

10. Reset State

External Script Fetching

Ssd 1

Tool Parameter Abuse

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Unrestricted Tool Access

Missing User Warnings

External Transmission

LLM-ready prompt injection text

External Transmission

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

External Transmission

LLM에 주입할 프롬프트 텍스트

External Transmission

Missing User Warnings

Missing User Warnings

Static analysis

Prompt-injection style instruction pattern detected.