ClawHub
Back to skill

Security audit

Emotion State

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it can store emotional profiles, send raw conversation text to external classifiers, and read emotion state from other agents by default.

Review before installing. Use this only if you are comfortable with conversation text being sent to OpenAI or a configured classifier, inferred emotional history being stored across sessions, and emotion summaries being injected into future prompts. For sensitive use, disable cross-agent sharing by setting EMOTION_MAX_OTHER_AGENTS to 0, avoid untrusted classifier URLs, and periodically inspect or delete the emotion-state.json files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation describes capabilities that require environment-variable access and outbound network use, but it does not declare or clearly surface those permissions. This creates a transparency and consent problem: operators may enable a prompt-injecting hook that can call external services and use API keys without understanding its effective privileges.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The hook injects an <emotion_state> block into bootstrap context as EMOTIONS.md, which changes the model's hidden prompt/state rather than merely tracking emotions. This creates an undeclared prompt-injection surface and can materially influence model behavior using persistent derived data that users may not see or control.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The handler enumerates sibling agent directories, reads their emotion-state files, and includes other agents' latest states in the current agent's injected context. This violates isolation expectations between agents and can leak sensitive inferred state across agents without a need tied to per-session emotion tracking.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill transmits raw conversation text to either a configurable external classifier endpoint or the OpenAI API for classification. That is a real data exfiltration/privacy risk because message content may contain secrets or sensitive personal data, and the code provides no minimization, consent, or trust boundary enforcement.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill persists inferred per-user emotion state across sessions and injects that state into the system prompt, but the description does not present this as a prominent warning or privacy-sensitive behavior. Because system-prompt injection changes model behavior globally and persistence creates longitudinal profiling, users and operators may unknowingly enable a feature with meaningful privacy and safety implications.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The configuration instructs operators to provide an API key and remote model endpoint, but it does not clearly warn that derived user-related data may be sent to an external service for classification. Even if raw text is not stored locally, remote inference can still expose sensitive behavioral or emotional inferences to a third party.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The hook documentation explicitly states that user/agent emotion content may be sent to an external HTTP classifier or to OpenAI, but it does not provide any privacy warning, consent requirement, or data-handling limitation. Because the data being processed is affective state and conversational context, this creates a real privacy and compliance risk through unintended exfiltration of sensitive user information to third parties.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The classifier functions send full message text to external HTTP services without any user-facing disclosure or consent mechanism in the code path. Even if intended for emotion analysis, this creates silent third-party sharing of potentially sensitive conversation data.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The writeJsonFile path persists emotion-derived state, including reasons, timestamps, and hashed source linkage, to disk without any visible notice, consent, retention policy, or access-control handling. Persistent inferred emotional profiles can be sensitive and create privacy and surveillance risks if accessed by other local users, backups, or adjacent components.

External Transmission

Medium
Category
Data Exfiltration
Content
"env": {
            "EMOTION_CLASSIFIER_URL": "",
            "OPENAI_API_KEY": "YOUR_KEY",
            "OPENAI_BASE_URL": "https://api.openai.com/v1",
            "EMOTION_MODEL": "gpt-4o-mini",
            "EMOTION_CONFIDENCE_MIN": "0.35",
            "EMOTION_HISTORY_SIZE": "100",
Confidence
76% confidence
Finding
https://api.openai.com/

External Transmission

Medium
Category
Data Exfiltration
Content
- `EMOTION_CLASSIFIER_URL`: Optional HTTP endpoint for classification.
- `OPENAI_API_KEY`: If set and no classifier URL, the hook calls OpenAI.
- `OPENAI_BASE_URL`: Default `https://api.openai.com/v1`.
- `EMOTION_MODEL`: Model name for OpenAI (default `gpt-4o-mini`).
- `EMOTION_CONFIDENCE_MIN`: Default `0.35`.
- `EMOTION_HISTORY_SIZE`: Default `100`.
Confidence
87% confidence
Finding
https://api.openai.com/

External Transmission

Medium
Category
Data Exfiltration
Content
async function classifyWithOpenAI(text: string, role: string, model: string) {
  const apiKey = envString("OPENAI_API_KEY");
  if (!apiKey) throw new Error("Missing OPENAI_API_KEY");
  const baseUrl = envString("OPENAI_BASE_URL", "https://api.openai.com/v1");
  const timeoutMs = envNumber("EMOTION_FETCH_TIMEOUT_MS", DEFAULTS.fetchTimeoutMs);
  const systemPrompt =
    "You are an emotion classifier. Return only JSON with keys: label, intensity, reason, confidence. " +
Confidence
94% confidence
Finding
https://api.openai.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
hooks/emotion-state/handler.ts:65