ClawHub
Back to skill

Security audit

Emotion State

Security checks for vulnerabilities and agentic risk

Overview

The skill’s emotion-tracking purpose is real, but it handles conversation text, persistent profiles, prompt injection, and cross-agent state with insufficient boundaries.

Review before installing. Only use this skill where users and agents have consented to emotion profiling, persistent state, and prompt influence. Prefer a trusted local or tightly allowlisted classifier, avoid arbitrary OPENAI_BASE_URL values, restrict filesystem access between agents, and add deletion/retention controls before using it with sensitive conversations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
hooks/emotion-state/handler.ts:269
Finding

Full Conversation Content and API Credentials Can Be Sent to Arbitrary Network Endpoints

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
hooks/emotion-state/handler.ts:325
Finding

Untrusted Classifier Output Is Persisted and Injected into Bootstrap Prompt Material

Content
View full analysis
file?.path === "EMOTIONS.md"); if (existing) { existing.content = content; existing.text = content; return; } context.bootstrapFiles.push({ path: "EMOTIONS.md", con ...[truncated 2806 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
hooks/emotion-state/handler.ts:429
Finding

Cross-Agent Emotion State Is Read and Exposed Without an Explicit Isolation Boundary

Content
View full analysis
(filePath); const latest = state?.agents?.[entry.name]?.latest || state?.users?.[entry.name]?.latest; if (latest) results.push({ id: entry.name, latest }); if (results.length >= maxAgents) break; } } catch (err) { console.error("[emotion-state] Failed to load other agents:", err); return []; } return results; } ``` The cross-agent read is performed during every applicable bootstrap: ```ts const otherAgents = await loadOtherAgents( getOtherAgentsRoot(agentDir), agentId, DEFAULTS.stateFileName, maxOtherAgents, ); ``` ### Technical Analysis The hook derives the shared agents root from the current agent directory, enumerates sibling agent directories, and reads each sibling's `emotion-state.json`. The resulting entries can contain inferred emotional labels and free-form reasons derived from another agent's conversations. Tracking the current user's and current agent's emotional state does not require access to sibling-agent state. This behavior therefore exceeds the minimum filesystem privilege necessary for the core declared functionality unless all sibling agents are deliberately part of a shared trust domain. There is no per-agent allowlist, access- ...[truncated 1644 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented behavior goes beyond the apparent purpose by persisting emotion state across sessions, reading agent state, and sending conversation-derived data to external classifier endpoints, while those capabilities are not clearly declared up front. This mismatch can mislead users into installing a component with broader data access and retention than expected, increasing privacy and prompt-manipulation risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code reads OPENAI_API_KEY and sends raw conversation text to an external classifier/OpenAI endpoint for emotion analysis. This is dangerous because user and assistant messages may contain secrets, personal data, or system prompts, and the skill exports that content off-box without minimization or clear necessity beyond local state tracking.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · hooks/emotion-state/handler.ts (reported line 363)May include surrounding context.

ts
.sort((a, b) => (a.ts < b.ts ? -1 : a.ts > b.ts ? 1 : 0));
  const toRemove = sorted.slice(0, keys.length - maxUsers);
  for (const { key } of toRemove) {
    delete state.users[key];
  }
}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises hook installation and configuration that clearly require environment access and outbound network capability, yet it declares no explicit tool scope or permissions. This weakens reviewability and consent, making it easier for a skill to access sensitive configuration and external services without clear operator awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Persisting inferred emotion data across sessions and injecting it into the system prompt changes future model behavior based on stored user profiling, but the description does not present this as a clear warning or consent point. In this context, hidden persistence plus prompt injection is especially sensitive because it can silently influence later interactions and expose private inferences beyond the original session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The configuration directs operators to use OpenAI or another classifier endpoint but does not clearly warn that conversation-derived emotional inferences may be sent to a third party. This creates a data handling and privacy risk because users may not realize sensitive behavioral profiling leaves the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The explicit external API base URL indicates the skill can transmit data to a third-party service. In a skill that analyzes and stores inferred emotional state, outbound transmission is more dangerous than ordinary telemetry because it may expose sensitive user profiling data and model-derived context to an external processor.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
"env": {
            "EMOTION_CLASSIFIER_URL": "",
            "OPENAI_API_KEY": "YOUR_KEY",
            "OPENAI_BASE_URL": "https://api.openai.com/v1",
            "EMOTION_MODEL": "gpt-4o-mini",
            "EMOTION_CONFIDENCE_MIN": "0.35",
            "EMOTION_HISTORY_SIZE": "100",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The hook documentation describes collecting, persisting, and later injecting emotional assessments into the system prompt, but it does not clearly warn users that these assessments may be stored in per-agent state and transmitted to external classifiers or OpenAI. This creates a meaningful privacy and transparency risk because sensitive inferred psychological data could be retained and exfiltrated without informed operator consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The hook is explicitly configured to send emotion-related content to an external HTTP endpoint or OpenAI when enabled. Because the content consists of inferred user/agent emotional state, this can expose sensitive behavioral or psychological data to third parties, and the risk is amplified by the hook's bootstrap-time prompt injection role, which may cause broad propagation of those inferences into subsequent model context.

Content

Scanner excerpt · hooks/emotion-state/HOOK.md (reported line 19)May include surrounding context.

md
- `EMOTION_CLASSIFIER_URL`: Optional HTTP endpoint for classification.
- `OPENAI_API_KEY`: If set and no classifier URL, the hook calls OpenAI.
- `OPENAI_BASE_URL`: Default `https://api.openai.com/v1`.
- `EMOTION_MODEL`: Model name for OpenAI (default `gpt-4o-mini`).
- `EMOTION_CONFIDENCE_MIN`: Default `0.35`.
- `EMOTION_HISTORY_SIZE`: Default `100`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill persists conversation-derived emotional profiles to disk in a predictable location, but there is no visible notice, retention policy enforcement, or access control in this file. Persistent profiling can outlive a session and expose sensitive inferences if local files are read by other skills, users, or processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The configurable classifier endpoint receives message content with no visible disclosure, consent, or trust restrictions in this code path. Because the URL is environment-controlled, the skill can silently exfiltrate conversation data to arbitrary infrastructure, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The OpenAI call ships conversation content to a third-party service without any visible user-facing warning or consent mechanism. In this skill context, message text is harvested automatically during bootstrap, so users may be unaware that their content is being analyzed and retained externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This is a concrete external transmission sink to the OpenAI API, carrying message text from the session to a network service. In the context of an emotion-tracking bootstrap hook, automatic egress of conversation content is particularly sensitive because it processes potentially private user inputs without strong boundaries or minimization.

Content

Scanner excerpt · hooks/emotion-state/handler.ts (reported line 284)May include surrounding context.

ts
async function classifyWithOpenAI(text: string, role: string, model: string) {
  const apiKey = envString("OPENAI_API_KEY");
  if (!apiKey) throw new Error("Missing OPENAI_API_KEY");
  const baseUrl = envString("OPENAI_BASE_URL", "https://api.openai.com/v1");
  const timeoutMs = envNumber("EMOTION_FETCH_TIMEOUT_MS", DEFAULTS.fetchTimeoutMs);
  const systemPrompt =
    "You are an emotion classifier. Return only JSON with keys: label, intensity, reason, confidence. " +

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The hook enumerates sibling agent directories and imports their latest emotional state into the current agent's bootstrap context, creating unauthorized cross-agent data access. In an agent platform, this breaks isolation boundaries and can expose private conversation-derived profiles from unrelated agents to prompts and downstream model behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code forces the 'en-CA' locale for formatting timestamps, which is a natural-language/locale choice applied regardless of user preference. There is no indication here that users can opt into this locale or that the locale restriction is justified by a region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
hooks/emotion-state/handler.ts:65