ClawHub
Back to skill

Security audit

Amber Hunter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local memory service, but it has serious review-worthy risks around plaintext secret storage, unauthenticated local access to private session data, and persistent background capture.

Review before installing. Use only if you are comfortable with a local service that reads agent sessions and workspace metadata, may use configured LLM/cloud credentials, and attempts background persistence. The plaintext master password and DID key storage plus unauthenticated local endpoints should be fixed before trusting it with sensitive memories.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T09 · Insecure Skill Coding Practices

Error
Location
amber_hunter.py:3368
Finding

Master Password Is Unconditionally Duplicated into a Plaintext Configuration File

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
amber_hunter.py:3987
Finding

DID Mnemonic and Device Private Key Are Persisted in Plaintext

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
amber_hunter.py:914
Finding

Session Summaries and Recent Workspace Files Are Exposed without Authentication

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
amber_hunter.py:895
Finding

Optional Authentication on the LLM Extraction Endpoint Permits Unauthorized Quota Use

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
install.sh:76
Finding

Installer Enables Persistent Background Session Monitoring without a Separate Opt-In

Content
View full analysis
"$PLIST" chmod 644 "$PLIST" launchctl unload "$PLIST" 2>/dev/null || true launchctl load "$PLIST" 2>/dev/null || true echo " ✅ amber-hunter LaunchAgent 已安装" # proactive 自动巡逻（每 10 分钟） NODE_BIN=$(command -v node 2>/dev/null || echo "") if [ -n "$NODE_BIN" ]; then PROACTIVE_PLIST="$HOME/Library/LaunchAgents/com.huper.amber-proactive.plist" sed -e "s|AMBER_NODE_PATH|$NODE_BIN|g" \ -e "s|AMBER_HUNTER_DIR|$HUNTER_DIR|g" \ -e "s|AMBER_HOME|$HOME|g" \ "$HUNTER_DIR/proactive/com.huper.amber-proactive.plist" > "$PROACTIVE_PLIST" chmod 644 "$PROACTIVE_PLIST" launchctl unload "$PROACTIVE_PLIST" 2>/dev/null || true launchctl load "$PROACTIVE_PLIST" 2>/dev/null || true fi elif $IS_LINUX; then systemctl --user daemon-reload 2>/dev/null || true systemctl --user enable amber-hunter 2>/dev/null || true systemctl --user start amber-hunter 2>/dev/null || true elif $IS_WINDOWS; then schtasks /create /tn "Amber Hunter" /tr "powershell -WindowStyle Hidden -File $SCRIPT" \ /sc onlogon /f 2>/dev/null || true fi ``` The persistent proactive process reads and processes session transcripts: ```javascript const sessionPath = getLatestSession(); if (!sessionPath) { log('[main] No session file found'); return; } const sessionId = path.basename(sessionPath, '.jsonl'); const messages = extractMessages(sessionPath); if (!isManual ...[truncated 1763 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:6
Finding

Installation and Release Workflows Execute Unpinned Third-Party Dependencies

Content
View full analysis
=2.2.0 numpy>=1.24.0 lancedb>=0.4.0 rank-bm25>=0.2.2 ragas>=0.1.0 ``` The installer resolves and installs these unconstrained future versions: ```bash if command -v pip &> /dev/null; then pip install -r "$HUNTER_DIR/requirements.txt" || \ pip3 install -r "$HUNTER_DIR/requirements.txt" elif command -v conda &> /dev/null; then conda install -q -y pip 2>/dev/null && pip install -r "$HUNTER_DIR/requirements.txt" fi ``` The release workflow also invokes an unversioned npm package: ```bash if npx clawhub whoami >/dev/null 2>&1; then npx clawhub publish . \ --slug amber-hunter \ --version "$CLEAN_VERSION" \ --changelog "${CHANGELOG_LINE:-Release $CLEAN_VERSION}" fi ``` ### Technical Analysis Minimum-version constraints allow dependency resolution to select any future compatible release. No hashes are supplied to authenticate downloaded distributions. The unversioned `npx clawhub` invocation can resolve and execute a package version that was not reviewed with this repository. Package installation and npm command execution can run package-supplied code with the invoking user's privileges. The audit did not identify a confirmed malicious dependency or typographical package name. The risk arises from mutable, unauthenticated dependency resolution. ### Attack Path 1. A dependency account, package release, registry, or transitive dependency is compromised. 2. A malicious future package version satisfies a `>=` requirement, or `npx` resolves an altered `clawhub` package. 3. A user runs `install.sh` or a maintainer runs `release.sh`. 4. The package manager downloads the unreviewed version. 5. Installation hooks, imports, or npm execution run attacker-controlled code with the u ...[truncated 585 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (257)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · AGENTS.md (reported line 1)May include surrounding context.

md
<!-- gitnexus:start -->
# GitNexus — Code Intelligence

This project is indexed by GitNexus as **amber-hunter** (930 symbols, 7750 relationships, 80 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly describes silent, automatic capture of AI session content and related files, which can collect sensitive user data without meaningful real-time consent or prominent privacy notice. In a skill context that monitors collaboration sessions, this creates substantial risk of overcollection and unexpected retention of private conversations, source code, and workspace artifacts.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The /master-password endpoint stores the master password in macOS Keychain and also writes it in plaintext to config.json as a fallback. Plaintext storage of the password undermines the whole local encryption model because any local process or backup that can read the config file can recover the key protecting user memories.

Content

Scanner excerpt · amber_hunter.py (reported line 3370)May include surrounding context.

python
@app.post("/master-password")
def set_master_password_handler(password_in: MasterPasswordIn, request: Request):
    """设置 master_password（存 macOS Keychain + config.json 双备份）"""
    client = request.client
    if client and client.host not in ("127.0.0.1", "::1", "localhost"):
        return JSONResponse({"error": "forbidden"}, status_code=403)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This specific code path writes cfg["master_password"] = password_in.password to config.json, creating a plaintext credential at rest. Because the same password is later used to derive encryption keys, compromise of this file leads directly to decryption of protected content and cloud-imported data.

Content

Scanner excerpt · amber_hunter.py (reported line 3375)May include surrounding context.

python
if client and client.host not in ("127.0.0.1", "::1", "localhost"):
        return JSONResponse({"error": "forbidden"}, status_code=403)
    ok1 = set_master_password(password_in.password)
    # 同时写到 config.json 作为 fallback（Keychain 访问可能受限）
    try:
        import json as _json
        cfg = {}

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The benchmark deletes all existing capsules on the configured service as part of setup, with no confirmation and no scoping to benchmark-owned data. In a real environment this can cause irreversible loss of unrelated data if the token has broad access or if the service is shared.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · benchmark/amber_bench.py (reported line 105)May include surrounding context.

python
def download_dataset():
    """Download LongMemEval dataset if not present. Uses curl for reliability."""
    DATA_PATH.parent.mkdir(parents=True, exist_ok=True)

    if DATA_PATH.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 345)May include surrounding context.

md
"""
core/keychain.py — 跨平台密钥管理
支持：macOS / Windows / Linux

存储策略：

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 186)May include surrounding context.

md
"""
core/keychain.py — 跨平台密钥管理
支持：macOS / Windows / Linux

存储策略：

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 252)May include surrounding context.

md
"""
core/keychain.py — 跨平台密钥管理
支持：macOS / Windows / Linux

存储策略：

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · amber_hunter.py (reported line 23)May include surrounding context.

python
"""
core/keychain.py — 跨平台密钥管理
支持：macOS / Windows / Linux

存储策略：

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · amber_hunter.py (reported line 3387)May include surrounding context.

python
"""
core/keychain.py — 跨平台密钥管理
支持：macOS / Windows / Linux

存储策略：

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/__init__.py (reported line 3)May include surrounding context.

python
"""
core/keychain.py — 跨平台密钥管理
支持：macOS / Windows / Linux

存储策略：

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/keychain.py (reported line 2)May include surrounding context.

python
"""
core/keychain.py — 跨平台密钥管理
支持：macOS / Windows / Linux

存储策略：

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 403)May include surrounding context.

md
支持：macOS / Windows / Linux

存储策略：
- macOS:     security 命令（Keychain）
- Windows:   cmdkey（凭据管理器）
- Linux:     secret-tool（libsecret/GNOME Keyring）
- Fallback:  config.json（仅限 api_token，master_password 必须用系统密钥链）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 186)May include surrounding context.

md
支持：macOS / Windows / Linux

存储策略：
- macOS:     security 命令（Keychain）
- Windows:   cmdkey（凭据管理器）
- Linux:     secret-tool（libsecret/GNOME Keyring）
- Fallback:  config.json（仅限 api_token，master_password 必须用系统密钥链）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/keychain.py (reported line 6)May include surrounding context.

python
支持：macOS / Windows / Linux

存储策略：
- macOS:     security 命令（Keychain）
- Windows:   cmdkey（凭据管理器）
- Linux:     secret-tool（libsecret/GNOME Keyring）
- Fallback:  config.json（仅限 api_token，master_password 必须用系统密钥链）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/keychain.py (reported line 211)May include surrounding context.

python
支持：macOS / Windows / Linux

存储策略：
- macOS:     security 命令（Keychain）
- Windows:   cmdkey（凭据管理器）
- Linux:     secret-tool（libsecret/GNOME Keyring）
- Fallback:  config.json（仅限 api_token，master_password 必须用系统密钥链）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 59)May include surrounding context.

sh
支持：macOS / Windows / Linux

存储策略：
- macOS:     security 命令（Keychain）
- Windows:   cmdkey（凭据管理器）
- Linux:     secret-tool（libsecret/GNOME Keyring）
- Fallback:  config.json（仅限 api_token，master_password 必须用系统密钥链）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/keychain.py (reported line 8)May include surrounding context.

python
存储策略：
- macOS:     security 命令（Keychain）
- Windows:   cmdkey（凭据管理器）
- Linux:     secret-tool（libsecret/GNOME Keyring）
- Fallback:  config.json（仅限 api_token，master_password 必须用系统密钥链）
"""
from __future__ import annotations

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/keychain.py (reported line 212)May include surrounding context.

python
存储策略：
- macOS:     security 命令（Keychain）
- Windows:   cmdkey（凭据管理器）
- Linux:     secret-tool（libsecret/GNOME Keyring）
- Fallback:  config.json（仅限 api_token，master_password 必须用系统密钥链）
"""
from __future__ import annotations

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 69)May include surrounding context.

sh
存储策略：
- macOS:     security 命令（Keychain）
- Windows:   cmdkey（凭据管理器）
- Linux:     secret-tool（libsecret/GNOME Keyring）
- Fallback:  config.json（仅限 api_token，master_password 必须用系统密钥链）
"""
from __future__ import annotations

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The module documentation states that master_password must be stored only in the system keychain, but Linux headless and Windows fallback logic allow reading or writing it from config.json in plaintext. This contract mismatch is dangerous because callers and users may rely on stronger storage guarantees than the code actually provides, leading to silent plaintext secret exposure on disk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

set_master_password() is documented as storing to the system keychain, but on Linux headless it routes through _credential_set() to _linux_config_set(), which writes plaintext to config.json. This creates a direct confidentiality risk for the application's most sensitive credential and violates the API's security expectations.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
92% confidence
Finding

Referencing ~/.claude/settings.json in auto-detection logic shows this module is designed to inspect another agent/tool's private configuration area. In a skill context, cross-tool config access is sensitive because those files may contain environment settings or identifiers the user did not intend to expose to this skill.

Content

Scanner excerpt · core/llm.py (reported line 547)May include surrounding context.

python
Priority:
    1. ANTHROPIC_MODEL env var (Claude Code explicit override)
    2. ~/.openclaw/openclaw.json → agents.defaults.model.primary
    3. ~/.claude/settings.json → env.ANTHROPIC_MODEL

    Returns ("", "", "") if no detection possible.
    """

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
94% confidence
Finding

This code path actively constructs a path to ~/.claude/settings.json for inspection during runtime. Access to another tool's config directory increases the risk of unauthorized collection of model settings and associated secrets in environments where skills should be sandboxed.

Content

Scanner excerpt · core/llm.py (reported line 572)May include surrounding context.

python
except:
            pass

    # 3. Claude Code settings: ~/.claude/settings.json → env.ANTHROPIC_MODEL
    claude_settings = os.path.expanduser("~/.claude/settings.json")
    if os.path.exists(claude_settings):
        try:

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
core/trainer.py:304

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
proactive/hooks/openclaw/handler.js:15

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
proactive/hooks/openclaw/handler.ts:21

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
core/llm.py:613

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
proactive/scripts/proactive-check.js:140