Amber Hunter

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 1.2.41

Overview

Amber Hunter is a real local memory skill, but it has broad always-on access to conversations and files plus under-disclosed security gaps around authentication and plaintext secrets.

Install only after reviewing the privacy tradeoff: this skill is designed to continuously collect and reuse AI-session memory, and it starts background services. Use it on a trusted single-user machine, avoid enabling cloud sync until you understand what is uploaded, do not rely on its current plaintext secret handling for high-value credentials or DID keys, and avoid running the benchmark cleanup scripts against real data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (75)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Fallback: cmdkey（密码无法被程序读回，但至少记录凭据存在）
    try:
        subprocess.run(["cmdkey", "/delete", target], capture_output=True)
        r = subprocess.run(
            ["cmdkey", "/generic:" + target, "/user:amber", "/pass:" + password],
            capture_output=True, timeout=5
        )

• Confidence: 88% confidence
• Finding: The Windows fallback passes the password on the command line to cmdkey. On many systems, command-line arguments may be visible to local users, process-monitoring tools, logs, or EDR products, causing credential exposure.

Tainted flow: 'del_req' from urllib.request.urlopen (line 71, network input) → urllib.request.urlopen (network output)

Medium

• Category: Data Flow

Content

method="DELETE"
                )
                try:
                    urllib.request.urlopen(del_req, timeout=5)
                except Exception:
                    pass
    except Exception:

• Confidence: 94% confidence
• Finding: The code deletes every capsule returned by the local service without confirmation, scoping, or validation of ownership. If run against a non-isolated Amber instance, this can destroy unrelated data and effectively acts as a mass-deletion primitive triggered by benchmark execution.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README documents a browser flow that treats huper.org calling localhost as 'same-origin', then recommends passing the API token in the query string to work around browser restrictions. Query-string secrets are commonly exposed via browser history, logs, referrers, process listings, and debugging tools, and the origin model claim is incorrect, which may lead implementers to deploy an unsafe auth design.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: Several WAL and profile endpoints are explicitly exposed without authentication and return session-derived entries and user profile data. Even if intended for localhost use, this service enables cross-origin access to trusted origins and includes other unauthenticated routes, so any local attacker, malicious browser context, or misconfigured deployment could retrieve sensitive personal memory data.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The OpenAI provider sets DEFAULT_URL to an already complete embeddings endpoint (https://api.openai.com/v1/embeddings) and then appends '/embeddings' again when making the request, producing an incorrect path by default. This breaks requests and can cause operators to workaround the issue by supplying custom base_url values, increasing misconfiguration risk and potentially sending data to unintended endpoints.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module documentation claims master_password must use the system keychain, but the implementation can read it from config.json on Windows and Linux headless systems. This mismatch can mislead users and developers into believing the secret is protected when it may actually reside in plaintext storage.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: set_master_password is documented as storing the secret in the system keychain, but on headless Linux it routes through _credential_set to _linux_set, which writes plaintext to config.json. This can expose the master password to any local user or process able to read the file, undermining the trust boundary of a master secret.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring states legacy amber-hunter tokens are skipped, but the implementation accepts a root-level api_key if it matches a pattern and then treats it as an LLM credential. This can silently repurpose a token the user did not intend to use for outbound LLM traffic, undermining operator expectations and potentially exposing secrets to an external service.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The reranker loads a Hugging Face model with trust_remote_code=True, which permits execution of model-repository supplied Python code during model initialization. In a component described as using a local reranker model, this expands the trust boundary significantly: if the model name is changed, the upstream repository is compromised, or dependencies fetch code dynamically, an attacker could achieve arbitrary code execution in the agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The trainer expands its corpus beyond the app's own memory store and recursively ingests user-role transcript text from ~/.openclaw/agents. That crosses an isolation boundary and can silently pull unrelated conversations into this model, creating privacy and data-minimization issues even if no external exfiltration occurs.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises continuous monitoring of agent sessions, transcript capture, and file-change collection without a prominent privacy warning or explicit opt-in language. In a local AI-assistant skill, that behavior can collect sensitive source code, secrets, and personal conversations, creating material privacy and data-handling risk even if the feature is intended.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The auto-sync feature states that frozen data is automatically uploaded to the cloud, but the documentation does not prominently warn users about the privacy consequences of transmitting captured session-derived data off-device. Even when encrypted, automatic cloud transfer changes the threat model and may violate user expectations around local-only memory storage.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The README describes silent automatic capture of 'significant moments' from AI collaboration sessions without a prominent caution that the system is continuously analyzing and storing user interactions. Silent background collection of conversation content, decisions, and preferences is especially risky in an AI tooling context because users may disclose secrets or sensitive business information during normal use.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The Active Recall section explains that prior memories are injected into future AI responses, but does not prominently warn that stored historical content may automatically influence later prompts and outputs. This can surface sensitive past data in new contexts, broaden unintended disclosure, and make prompt context harder for users to reason about.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The repeated proactive-capture documentation normalizes silent automatic storage and scheduled background execution every 10 minutes without a strong warning about ongoing monitoring. Repetition of the 'silently' behavior, combined with persistence, increases the likelihood that users enable surveillance-like functionality without fully understanding its scope.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation describes auto_sync, Huper cloud API integration, DID registration, and cloud effectiveness without a prominent warning that memory content or metadata may leave the local machine. For a memory system storing sensitive long-term context, unclear disclosure of outbound data flows materially increases privacy and exfiltration risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code writes sensitive secrets such as API keys and the master password into config files on disk, including a plaintext fallback for the master password. Storing credentials in plaintext materially weakens the intended security model because filesystem compromise, backups, or other local processes can recover them.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: DID setup writes the device private key and mnemonic seed to ~/.amber-hunter/did.json in cleartext. Exposure of either value enables identity takeover, decryption capability derivation, and compromise across devices, making this highly sensitive key material that should never be stored unprotected.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The benchmark clears all existing capsules automatically as part of setup, with no confirmation or opt-in. In context, this is more dangerous because the script targets a live local service and may be run by developers against environments containing real data, leading to accidental irreversible data loss.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script sends session text content from the dataset to a local HTTP memory service without an explicit disclosure or privacy boundary. While the destination is localhost, this still transfers potentially sensitive conversational data into another process/service, increasing exposure if that service logs, persists, or forwards content.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script unconditionally calls clear_all() before running the benchmark, which deletes all existing capsules from the target service without confirmation or scoping the deletion to benchmark-owned data. In context, this is more dangerous because it interacts with a live local service and can destroy unrelated user data if pointed at a non-isolated environment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code stores potentially sensitive capsule data, including memo, content, session metadata, window titles, and URLs, in a local SQLite database under the user's home directory without any encryption or consent/disclosure mechanism visible in this file. If the host is compromised, backed up to less-trusted locations, or accessed by other local processes/users, this can expose highly sensitive behavioral and content data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User profile sections are persistently stored in plaintext with timestamps and source/session context, which can reveal personal preferences, identity details, or other sensitive profile information. In an agent skill context, long-lived profile memory increases privacy risk because the data may accumulate over time and be more sensitive than ordinary application state.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends recent user conversation text to an LLM for memory extraction, including personal facts and preferences, without any visible consent, minimization, or policy gating in this file. In a memory-extraction skill, this increases privacy and data-handling risk because sensitive user content may be transmitted to a model backend and retained or processed beyond the user's expectations.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The headless Linux fallback writes credentials directly into config.json in plaintext, and the code does not enforce restrictive file permissions or obtain explicit user confirmation at the write path. If the home directory is backed up, synced, or readable by other local contexts, stored secrets can be trivially recovered.

VirusTotal

38/38 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: core/trainer.py:304

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: proactive/hooks/openclaw/handler.js:15

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: proactive/hooks/openclaw/handler.ts:21

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: core/llm.py:613

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: proactive/scripts/proactive-check.js:140