ClawHub
Back to skill

Security audit

Emoji Reaction Automator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local emoji-reaction helper with no evidence of hidden access, persistence, network activity, or harmful behavior.

Before installing, note that this is a lightweight keyword matcher, not robust sentiment analysis. It should be fine for local emoji suggestions, but users should not expect nuanced moderation or privacy-sensitive message handling from it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The code largely matches the stated purpose: it analyzes input text and suggests an emoji reaction. However, the declared description specifically lists positive, negative, funny, and neutral, while the implementation also classifies messages as curious and excited, which are undeclared behavioral categories. Additionally, the function returns structured metadata including category and confidence, not just an emoji suggestion. These are relatively minor but real behavior-description differences, so this is a low-to-moderate mismatch rather than a severe one. No suspicious resource access or unrelated external actions are present.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description says the skill suggests emoji reactions based on sentiment analysis with categories positive, negative, funny, and neutral. The actual code shown does not implement sentiment analysis directly; it tests an exported suggestReaction function and expects categories including 'curious' and 'excited', which are not mentioned in the description. That means the behavior implied by the tests is broader than the declared purpose. This is a modest but real description-behavior mismatch because the supported outputs extend beyond the declared category set.

Description-Behavior Mismatch

Low
Confidence
95% confidence
Finding
The manifest describes a limited sentiment taxonomy of positive, negative, funny, and neutral. The implementation expands behavior by introducing additional categories and corresponding emoji outputs, which is a semantic mismatch between the stated skill behavior and actual code behavior.

Vague Triggers

Low
Confidence
88% confidence
Finding
This manifest description says the skill provides 'Automated emoji reaction suggestions based on message sentiment' but does not specify when it should activate, what messages it applies to, or any limiting context. For manifest files, vague invocation descriptions can cause unintended triggering because the scope and exclusions are not clearly defined.

Static analysis

No suspicious patterns detected.