Emoji Wrapper

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: emoji-wrapper Version: 1.0.0 The emoji-wrapper skill is a functional integration layer for the local-auto-emoji dependency, designed to process text markers (e.g., [可爱]) and return corresponding emoji images. The code in script.py and test_wrapper.py focuses entirely on message interception, user session identification, and calling the underlying emoji logic, with no evidence of data exfiltration, malicious execution, or harmful prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Messages containing bracketed emoji markers may trigger extra text or image messages without a separate confirmation step.

Why it was flagged

The skill is explicitly designed to inspect messages and automatically transform marker text into media outputs. This is aligned with its purpose, but it affects all message content it processes.

Skill content
- Intercepts all incoming messages
- Detects `[标记]` patterns ...
- Replaces them with actual emoji images (MEDIA instructions)
Recommendation

Install only if you want this automatic emoji expansion behavior, and disable it if you do not want incoming messages scanned for markers.

What this means

If the local-auto-emoji skill is missing, untrusted, or modified, this wrapper's behavior can change or fail.

Why it was flagged

The wrapper imports and runs code from a separate local-auto-emoji skill located in the workspace. The dependency is disclosed, but its behavior depends on that separate local code.

Skill content
LOCAL_EMOJI_PATH = _workspace_root / "skills" / "local-auto-emoji" / "scripts"
...
sys.path.insert(0, str(LOCAL_EMOJI_PATH))
...
from send_emoji import LocalAutoEmoji
Recommendation

Review and install local-auto-emoji from a trusted source before enabling this wrapper.

What this means

The skill may create or reuse a local emoji profile associated with a user or channel identifier.

Why it was flagged

The wrapper uses the session/user ID to create or select a user entry in the local emoji system, so emoji behavior may depend on per-user local state.

Skill content
if userid not in self.bot.manager.index["users"]:
    self.bot.ensure_user(userid)
self.bot.userid = userid
Recommendation

Understand where local-auto-emoji stores user emoji packs or indexes, and remove that local state if you no longer want per-user emoji behavior.