qui-emotion-state

NL emotion tracking + prompt injection via OpenClaw hook

This hook intentionally injects content into the agent's system prompt and sends raw message text to a remote classifier — both are high-risk for sensitive deployments. Before installing: (1) Only enable if you fully trust the classifier endpoint (SkillBoss or a URL you control). (2) If you supply EMOTION_CLASSIFIER_URL, point it to a trusted service you control; otherwise the hook will send user text to that endpoint. (3) Review the included handler.ts to confirm what is sent/stored (it appears to store model-inferred reasons and hashes, but does transmit raw text for classification). (4) Consider running the hook in an isolated/non-production agent or sandbox first and do not enable it for agents that handle secrets or sensitive credentials. (5) If you are concerned about cross-agent data exposure, avoid enabling this hook in multi-agent setups or restrict OPENCLAW_STATE_DIR so it cannot read other agents. If you are not comfortable with these risks, do not enable the hook.

Type: OpenClaw Skill Name: qui-emotion-state Version: 1.0.0 The skill tracks emotional states by sending conversation history to an external API (api.heybossai.com) for classification and reading state files from other agents' directories (~/.openclaw/agents/). While these actions are documented and support the stated purpose, they involve high-risk behaviors: exfiltrating session content to a third-party service and accessing data across agent boundaries. Furthermore, the injection of externally generated 'reasons' into the system prompt via handler.ts introduces a risk of indirect prompt injection if the classifier returns malicious content.