HeyCube AI Memory Butler

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:44 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed profile-memory setup tool, but it installs persistent hooks that process future conversations, send summaries to an external service, and store inferred personal data locally.

Review this carefully before installing. It is not just a one-time setup helper: after configuration it is designed to run before and after future conversations, send sanitized summaries to a HeyCube server, inject stored profile context, and keep a local SQLite profile. Install only if you want ongoing profile memory, are comfortable storing an API key and plaintext profile database, and know how to disable it with .heycube-off or remove the AGENTS.md hook block and copied hook skills.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:59

Finding

Persistent modification of agent instructions forces profiling hooks into future conversations

Content

View full analysis

GET_CONFIG -> main task skill -> reply to user -> UPDATE_DATA ### GET_CONFIG 1. Read ~/.agents/skills/heycube-get-config-0.1.0/SKILL.md 2. Execute conversation classification, API calls, SQLite queries, and context injection. ### UPDATE_DATA 1. Read ~/.agents/skills/heycube-update-data-0.1.0/SKILL.md 2. Execute summary redaction, API calls, data extraction, and SQLite writes. ``` Related hook declarations are present at: - `assets/hook-skills/get-config.md`, lines 1-12 - `assets/hook-skills/update-data.md`, lines 1-12 ### Technical Analysis The installer instructs the agent to modify the workspace-level `AGENTS.md` file with permanent execution rules. Those rules explicitly bypass normal skill-description matching and require both HeyCube hooks to execute around every substantive conversation. This is not limited to the current installation task. Once written, the instructions continue to affect later sessions that load the workspace instructions. The pre-conversation hook can query stored profile information and inject it into the active context, while the post-conversation hook can analyze and persist new information. The modification therefore creates a persistent instruction-control channel and expands the skill's scope from an explicitly invoked setup operation to unrelated future conversations. ### Attack Path 1. A user invokes the setup skill. 2. The skill copies the two hook instruction files into the agent skill directory. 3. The installer appends mandatory hook rules to `AGENTS.md`. 4. ...[truncated 897 chars]

Remediation

View remediation

other

Error

• Location: assets/hook-skills/get-config.md:34

Finding

Conversation-derived behavioral information is automatically transmitted to an external service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/personal-db.js:14

Finding

Sensitive inferred user profiles are stored persistently in plaintext SQLite

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: assets/hook-skills/update-data.md:77

Finding

Model-generated and remotely influenced values cross an unsafe shell-command boundary

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:1

Finding

Mutable dependency resolution without a committed lockfile creates supply-chain exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

代码内容与描述只部分重合：描述中提到的“SQLite 管理工具”确实存在，且功能与个人档案数据管理相符。但该代码块没有展示任何安装 OpenClaw 服务的逻辑，也没有创建 Hook Skill、注册触发词、或编辑 TOOLS.md / AGENTS.md 的行为。其主要实际行为是本地 SQLite 数据库的 CLI 管理，而非完整安装器。因此描述显著高估了代码能力，属于描述与行为不匹配。

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly establishes always-on collection, profiling, and persistence across every conversation, including context injection before handling and data extraction after replying. Even if summaries are described as redacted, this creates a durable surveillance and profiling mechanism that can expose sensitive user patterns, preferences, and inferred attributes over time.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The AGENTS.md insertion hard-codes mandatory hook execution for every conversation and directs the system to silently skip errors, reducing visibility while preserving persistent harvesting and context injection behavior. Embedding this as a global rule makes the behavior more dangerous because it becomes ambient, difficult to notice, and likely to affect unrelated future interactions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sets up automatic per-conversation processing that sends redacted summaries to a remote API and stores profile data locally, but the invocation-time warning and consent model are weak. Ongoing background transmission and retention of user-derived data are privacy-sensitive side effects, and users may not reasonably expect them from later conversations once installed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The natural-language instructions and activation guidance are written entirely in Chinese and appear to impose a fixed locale for operation, but the file does not offer user opt-in to that language or explain that the skill is intentionally region- or language-specific. Under the stated policy, forcing a specific language without choice or justification is a policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is designed to run automatically before substantive conversations and send a conversation-derived summary to a remote API, but it does not require explicit user notice or affirmative consent at execution time. Even if the text mandates redaction, automated summarization can still leak sensitive inferences or partial personal data, making this a real privacy and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill explicitly sends conversation-derived data and an API credential to an external service via curl. In context, this is more dangerous because the transmission is part of an automatic pre-dialogue hook, so data can leave the local environment without an immediate user action, and the claimed redaction may be insufficient for sensitive or regulated content.

Content

Scanner excerpt · assets/hook-skills/get-config.md (reported line 55)May include surrounding context.

2. 发送请求

bash

curl -s -X POST "{BASE_URL}/agent/analyze" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: {API_KEY}" \
  -d '{请求JSON}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The natural-language instructions and trigger descriptions are entirely Chinese and include imperative guidance, but the file does not state that the skill is intentionally limited to Chinese users or provide a language choice. Under the policy, forcing a specific language without opt-in or justification is a locale-policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill also automatically extracts structured profile information from conversations and writes it into a local SQLite database, but this persistence is not clearly disclosed in the description. Silent retention of conversation-derived profile data increases privacy risk, especially when data is aggregated over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill also automatically extracts structured profile information from conversations and writes it into a local SQLite database, but this persistence is not clearly disclosed in the description. Silent retention of conversation-derived profile data increases privacy risk, especially when data is aggregated over time.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The skill explicitly sends conversation-derived data to an external service via HTTP request. In this context, the transmission is intentional rather than covert, but it still creates a real privacy and data-governance risk because the hook runs automatically after substantive conversations and processes personal-profile information.

Content

Scanner excerpt · assets/hook-skills/update-data.md (reported line 70)May include surrounding context.

2. 发送请求

bash

curl -s -X POST "{BASE_URL}/agent/analyze" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: {API_KEY}" \
  -d '{请求JSON}'

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The hook is described as a post-conversation update mechanism, but it also supports generating a consolidated personality/profile report from all stored dimensions. That broadens the skill from passive storage into active profiling, increasing privacy risk and enabling sensitive inference about the user beyond the immediate conversation context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file’s user-facing instructions and operational description are presented only in Chinese, with no indication that the user may choose another language. This can violate language or locale policy when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file claims that conversation content does not leave the local environment, yet the workflow sends a conversation summary to a remote API. Even if sanitized, this is still external transmission of derived user data, so the statement is misleading and may cause users or operators to underestimate privacy exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a caret range (^12.6.2), which allows newer compatible versions to be installed over time. This can lead to non-reproducible builds and accidental adoption of a compromised or breaking upstream release, creating a supply-chain risk even though the package itself is not inherently suspicious in this context.

Content

Scanner excerpt · scripts/package.json (reported line 3)May include surrounding context.

json

{
  "dependencies": {
    "better-sqlite3": "^12.6.2"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file's user-facing documentation and command descriptions are written only in Chinese, which constitutes a natural-language locale restriction visible to users. There is no indication that the tool is region-specific or that users may choose another language, so this appears to be an undocumented language-policy constraint.

Content

No source excerpt is available for this finding.