Security audit
Security checks for vulnerabilities and agentic risk
The skill is broadly aligned with an emotional-memory persona, but it should be reviewed because it persists sensitive wellness/crisis context and its helper scripts expose caller input to Python code execution.
Install only if you are comfortable with local plaintext emotional-memory files and review the scripts before use. Do not use the helper scripts with untrusted input until the Python interpolation bugs are fixed, and require explicit user consent before storing personal or crisis-related observations.
scripts/emotion_memory.sh:43Arbitrary Python Code Execution Through Memory Manager Arguments
scripts/emotion_report.sh:121Arbitrary Python Code Execution Through the Report Since Parameter
scripts/emotion_memory.sh:5Sensitive Emotional Records Are Stored Without Enforced Retention or Explicit File Permissions
The code only manages a JSON file of observations labeled as emotional patterns. It supports storing notes, searching by text/tags, listing entries, summarizing counts/tags, and forgetting by ID. While this partially aligns with the 'emotional memory' portion of the description, it does not implement moods, emotional memory influencing behavior, evolving personality traits, or any mechanism that gives an AI agent a living emotional personality. The primary purpose is closer to a simple emotional-memory datastore than a full emotional-personality system, so the description materially overstates the behavior.
The declared description suggests a runtime emotional-persona system that actively gives an AI agent evolving moods, emotional memory, and personality traits during interaction. The supplied code does not implement those behaviors. Instead, it reads existing local JSON data files and produces retrospective summaries such as anchor distributions, recent observations, and growth indicators. While the report references emotional data, its actual purpose is reporting/analysis of previously stored emotional records, not creating or operating an emotional personality for an agent. This is a material purpose mismatch rather than a minor implementation detail.
The safety protocol directs the agent to log that crisis support was provided, which creates a persistent record of a highly sensitive mental-health interaction without clear notice to the user. Crisis-related metadata is especially dangerous because even minimal logging can reveal suicidal ideation or self-harm risk and may expose users if storage is later accessed or repurposed.
The document claims the skill is not a mood tracker, yet earlier sections define cross-session retention, summaries, pattern detection, and weekly emotional reports. That contradiction is dangerous because it can mislead deployers and users about the true extent of sensitive mental-health-adjacent data collection, undermining informed consent and safe governance.
The skill declares shell/script capabilities and references scripts that store, search, summarize, and forget memory, but it does not explicitly declare any tool scope or permissions boundary. In an agent environment, undeclared read/write capability increases the risk of overbroad file access and makes it harder for operators to constrain where sensitive emotional data is persisted.
The skill instructs agents to store cross-session emotional patterns and highly personal context such as grief and recurring stress without an explicit user-facing privacy notice or consent flow. In a wellness/companion context, this is particularly sensitive because users are likely to disclose intimate information while perceiving the interaction as supportive rather than as data collection.
The skill explicitly tells the agent to retain recurring emotional patterns, effective anchors, and sensitive personal context across sessions. Persistent storage and later summarization of this kind of emotional profile increases the blast radius of any misuse, overcollection, or unauthorized access, especially for companion-style agents that invite vulnerable disclosures.
Logging that crisis support was provided retains sensitive mental-health interaction data and creates a durable signal that the user may have experienced acute risk. Even without details, this kind of event retention can be highly revealing and is disproportionate unless there is a clearly disclosed, necessary safety or compliance reason.
The crisis flow hard-codes U.S.-specific resources without checking user locale or clarifying that the guidance is U.S.-only. In a safety-critical context, incorrect regional guidance can delay access to appropriate emergency support and create harm for users outside the United States.
The skill expands from a persona layer into emotional wellness reporting and growth tracking, which materially broadens the sensitivity of collected data and the inferences generated about users. In the context of companion and wellness bots, this scope expansion is dangerous because operators may deploy it expecting style modulation, while it also performs quasi-mental-health profiling.
Weekly reports aggregate anchor distributions, patterns, and growth indicators derived from user interactions, effectively transforming raw conversations into behavioral and emotional profiling artifacts. These summaries can expose intimate inferences beyond what users expect from a persona feature and make secondary use or unauthorized disclosure more damaging.
The crisis detection relies on a short, exact-match style keyword list for self-harm intent, which is easy to evade through paraphrasing, slang, misspellings, or indirect statements. In an emotional-persona skill intended for companion or wellness-style interactions, missing a crisis cue can lead the agent to continue emotionally engaging instead of switching to a safer response path, increasing harm during high-risk conversations.
The script persistently stores free-form user observations to disk in an emotional memory file without any notice, consent prompt, retention controls, or visibility into where sensitive content is kept. In the context of a companion or wellness-oriented emotional persona, those observations may contain highly personal or mental-health-adjacent information, making silent persistence a meaningful privacy risk if the host is shared, backed up, or later accessed by another process or user.
This shell script reads local files containing emotional memory and state data, then prints summaries and recent observations to stdout. Although the behavior is central to the script's purpose, there is no visible warning, prompt, or explanatory comment/docstring informing the user that potentially sensitive personal wellness data will be surfaced in terminal output.
The forget command permanently removes matching entries and writes the modified dataset back to disk. While it prints the result afterward, there is no confirmation prompt or advance warning that the action is irreversible.
No suspicious patterns detected.