Security audit

Hui-Yi

Security checks across malware telemetry and agentic risk

Overview

Hui-Yi is a disclosed local cold-memory tool with an optional opt-in hook that persists memory-use signals, so it should be enabled deliberately but does not show malicious behavior.

Install only if you want a local persistent cold-memory archive. Review the hook template before running install_hook.py --enable, keep HUI_YI_HOOK_DEBUG unset unless briefly troubleshooting, and disable the hook in openclaw.json if you do not want recall-like conversations to update memory activation metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The playbook broadens use of the skill beyond the manifest’s explicit-request-only scope by authorizing periodic cooling, heartbeat maintenance, and daily-note processing. This can cause the agent to invoke archival behavior without clear user consent, leading to unintended persistence or restructuring of user data and weakening the skill’s safety boundary.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document states Hui-Yi scripts only write to `memory/cold/` and `memory/heartbeat-state.json`, yet later mandates running `rebuild.py`, which updates `tags.json` and `index.md`. This inconsistency can mislead reviewers and agents about the real write scope, increasing the chance of unauthorized or broader-than-expected modifications to memory metadata.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The hook’s heuristic intent detector activates on broad phrases like 'do you remember' or '有记录吗', even though the skill metadata says it should only run for explicit recall/archive requests. In this skill, activation is not read-only: it can feed directly into the signal pipeline and eventually update cold-memory tracking state, so ordinary conversation can silently influence persistent memory records.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: When heuristicIntent is true, the handler proceeds exactly like an explicit skill hit and calls runSignalPipeline, which can write back to note files and tags.json. That means inferred intent from user text can mutate long-term cold-memory artifacts without the manifest’s explicit-request-only constraint being satisfied.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The semantic trigger examples include very common phrases such as "do you remember" and "archive this," which can appear in ordinary conversation and may cause the higher-level agent to invoke the skill unnecessarily. In this skill's context, that matters because Hui-Yi is tied to reading and updating cold-memory artifacts, so over-triggering can expose historical notes or cause unintended archival/maintenance actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code documents and enables a debug mode that restores verbose diagnostics with raw identifiers and body previews. Although gated by an environment variable, once enabled it causes sensitive conversational data to be persisted to disk without any in-band notice, which is a privacy/security weakness for a memory-oriented skill handling historical context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: In debug mode, the 'alive' log entry writes channel identifiers, parsed sender information, full event metadata, and a body preview to hook.log. For a recall/archive hook, this can expose sensitive user, chat, and message context on disk beyond the main application data flow, increasing privacy and forensic leakage risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: For skipped events, debug logging still writes body previews to disk even though the hook decided the message was unrelated. This expands collection to non-triggering conversations, which is especially problematic because the skill is supposed to be narrowly scoped to explicit cold-memory recall behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Triggered-event debug logging stores raw scope IDs, thread IDs, and message previews when DEBUG_LOG is enabled. Those identifiers can be directly sensitive or linkable, and combined with content previews they create a durable mapping between users/chats and recall-related conversations in local logs.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The template leaves the 'Triggers' and 'Use this when' sections unconstrained, which can cause downstream notes to define overly broad activation conditions. In a memory-recall skill, ambiguous triggers increase the chance of unintended invocation, causing irrelevant or stale archival context to be surfaced when not explicitly requested.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.