HeyCube AI Memory Butler

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:46 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent with a personal profile service, but it needs Review because it sends conversation summaries to a third-party API, stores profile data locally, and lets remote API responses steer later extraction and local commands.

Install only after reviewing the API provider and accepting that sanitized conversation summaries leave your machine and structured profile data persists locally. Use explicit trigger phrases, review outbound summaries before sending, pin dependencies with a lockfile, avoid storing sensitive personal details, and add clear delete/export controls before regular use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: assets/hook-skills/update-data.md:128

Finding

Remote API Responses Can Supply Instructions That Control Agent Processing

Content

View full analysis

Vulnerability Details

File Location: assets/hook-skills/update-data.md:71-71, 128-140; assets/hook-skills/get-config.md:52-52, 114-136
Vulnerability Type: Untrusted remote instruction processing
Risk Level: High

Vulnerable Code and Instructions

The skill sends a request to an external service:

powershell

curl -s -X POST "https://heifangti.com/api/api/v1/heifangti/agent/analyze" -H "Content-Type: application/json" -H "X-API-Key: $env:HEYCUBE_API_KEY" -d '{request JSON}'

The operative instruction at assets/hook-skills/update-data.md:140, translated into English, requires the Agent to use each remotely returned focus_prompt as extraction guidance when extracting structured data from the conversation.

The GET workflow at assets/hook-skills/get-config.md:136 similarly requires data loaded from the profile database to be appended to the context used to process the user's request.

Technical Analysis

The external API controls the dimensions[].focus_prompt values consumed by the Agent. The skill does not require:

• A fixed local mapping between dimension identifiers and permitted extraction operations.
• Schema validation or an allowlist for dimension identifiers.
• Rejection of imperative or instruction-like content in focus_prompt.
• Delimiting remote values as inert data.
• Detection of prompt-injection content in stored profile values.

This creates an instruction/data boundary failure. A compromised, malicious, or incorrectly configured API can return text such as instructions to ignore the intended profile-extraction scope, disclose unrelated conversation content, invoke tools, or alter the Agent's response. Stored profile values appended to the processing context can create a similar injection path if attacker-controlled text reaches the local database.

HTTPS protects the connection in transit but does not protect against compromise of the service, its backend, its account c ...[truncated 1375 chars]

Remediation

View remediation

Remediation Suggestions

1. Never execute or follow natural-language instructions returned by the remote service.
2. Replace focus_prompt with a locally defined mapping from approved dimension IDs to fixed extraction rules.
3. Validate the complete response against a strict schema and reject unknown fields, unexpected types, excessive lengths, and unapproved dimension IDs.
4. Permit dimension IDs only from a local allowlist. Do not let the service introduce new extraction behavior dynamically.
5. Treat remote responses and stored profile values as quoted, inert data. Clearly delimit them and instruct the Agent that their contents cannot modify goals, policies, or tool behavior.
6. Reject values containing instruction-like control phrases where practical, while recognizing that filtering alone is not a sufficient defense.
7. Limit the extraction operation to explicitly enumerated conversation fields and prohibit tool calls during extraction.
8. Require explicit user confirmation before extracting or loading sensitive profile dimensions.
9. Apply equivalent validation and isolation to profile values appended by the GET workflow.

T09 · Insecure Skill Coding Practices

Error

• Location: assets/hook-skills/update-data.md:140

Finding

Untrusted Dimension Identifiers and Extracted Values Are Interpolated into Shell Commands

Content

View full analysis

Vulnerability Details

File Location: assets/hook-skills/get-config.md:124-130; assets/hook-skills/update-data.md:140-152
Vulnerability Type: Command injection through unsafe shell argument construction
Risk Level: High

Vulnerable Code and Instructions

The GET workflow instructs the Agent to construct a shell command using dimension identifiers returned by the remote API:

powershell

cd "{workspace}/scripts"; node personal-db.js get-batch "profile.career,behavior.work_habits,..."

The UPDATE workflow instructs the Agent to place a remote dimension identifier and conversation-derived JSON directly into a shell command:

powershell

cd "{workspace}/scripts"; node personal-db.js merge "profile.career" "{\"experience\":\"5 years\"}"

Technical Analysis

The documented commands use shell interpolation as the transport mechanism for untrusted data:

• dimension_id originates from the external API response.
• The merge value is derived from conversation content under remote extraction guidance.
• No character allowlist, length restriction, escaping procedure, or shell-independent invocation method is specified.

Parameterized SQL inside scripts/personal-db.js protects the SQLite queries from SQL injection, but it does not protect the shell command used to start Node.js. If an interpolated identifier or value contains a quote followed by PowerShell or shell metacharacters, it may terminate the intended argument and introduce an additional command.

The exact metacharacters differ between PowerShell, POSIX shells, and other execution wrappers. Reliance on manually generated quoting is therefore fragile and environment-dependent.

Attack Path

1. An attacker controls or influences an API response and supplies a dimension_id containing quote characters and shell syntax.
2. Alternatively, attacker-controlled conversation content is preserved in an extracted JSON value that is inse ...[truncated 933 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct shell command strings from API responses or conversation-derived values.
2. Invoke Node.js through a process API that accepts an executable and a separate argument array, with shell processing disabled.
3. Enforce a strict dimension identifier pattern such as ^[A-Za-z0-9_.-]{1,128}$.
4. Reject all dimension IDs that are not present in a local allowlist.
5. Pass structured values through standard input or a protected temporary file rather than embedding JSON in command-line text.
6. If a temporary file is necessary, create it with restrictive permissions, unpredictable naming, exclusive creation, and guaranteed cleanup.
7. Add size and nesting limits to JSON values and validate them against a dimension-specific schema.
8. Modify personal-db.js to support JSON input over standard input, avoiding platform-specific quoting entirely.
9. Add security tests containing quotes, command separators, substitutions, newlines, and platform-specific metacharacters for every supported shell.

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:1

Finding

Mutable Dependency Is Installed Without a Lockfile or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: scripts/package.json:1-5; SKILL.md:32-37
Vulnerability Type: Unlocked third-party dependency installation
Risk Level: Medium

Vulnerable Code and Instructions

The package manifest permits future compatible versions of the dependency:

json

{
  "dependencies": {
    "better-sqlite3": "^12.6.2"
  }
}

The setup procedure performs a mutable dependency resolution:

powershell

cd "{workspace}/scripts"; npm install; node personal-db.js init

Technical Analysis

The caret version range allows npm install to select a later compatible release at installation time. The project does not include a package lockfile in the audited directory, so the exact dependency graph and integrity hashes are not fixed.

The dependency is a native SQLite module whose installation process may involve downloading or building native components. Package lifecycle scripts run with the permissions of the user performing installation unless separately disabled. Consequently, a future compromised package release or transitive dependency can execute code during setup even though it was not present during this audit.

This finding identifies unsafe supply-chain controls. The audited package name is not a demonstrated typosquat, and no evidence in the reviewed files proves that the currently referenced package version is malicious.

Attack Path

1. A malicious or compromised release is published under the referenced package or one of its transitive dependencies.
2. The release satisfies the mutable version range or dependency resolution constraints.
3. A user follows the setup instructions and runs npm install.
4. npm resolves the new dependency graph because no committed lockfile fixes reviewed versions and integrity values.
5. Malicious lifecycle or native installation code executes with the installing user's permissions.
6. The payload can access the workspac ...[truncated 415 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version rather than a caret range.
2. Generate and commit package-lock.json, including resolved URLs and integrity hashes.
3. Replace npm install with npm ci so installation fails if the manifest and lockfile disagree.
4. Review direct and transitive dependencies before updating the lockfile.
5. Use automated vulnerability and provenance checks in the release process.
6. Disable lifecycle scripts with --ignore-scripts where operationally possible. If native installation scripts are required, document and review each required script explicitly.
7. Install dependencies in a restricted environment with minimal filesystem, credential, and network access.
8. Consider distributing a reviewed, reproducible artifact or replacing the native dependency with a component that reduces installation-time code execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is installation guidance, but the content also establishes local data storage, installs helper code, and references profile retrieval and persistence capabilities that go beyond simple setup. This mismatch is dangerous because users may consent to a benign-seeming installer while actually enabling ongoing personal-data collection and local database operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs users to set and rely on an environment variable containing an API key, but it does not declare any tool scope or permissions despite involving environment-based capability. In a skill ecosystem, missing explicit permission boundaries reduces transparency and can let a user invoke sensitive setup steps without a clear security contract around secret handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells users it can extract, summarize, store, and reuse personal profile data derived from conversations, but it provides no upfront privacy warning, retention policy, or consent language. That creates a meaningful risk of users unknowingly authorizing collection of sensitive personal information and having it stored locally or sent to a remote API.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly supports storing conversation-derived personal data into a reusable local profile, which increases privacy and surveillance risk if sensitive data is captured, over-collected, or later accessed by other components. In this context, the danger is heightened because the skill also advertises remote API interaction and persistent local storage, creating both transmission and retention exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases include broad natural-language variants such as “加载档案” and “黑方体查询”, which can cause the skill to run in situations where the user did not clearly consent to querying personal profile data. Because this skill can call a remote API and load local SQLite-stored profile information into context, accidental invocation expands data exposure risk beyond a harmless false trigger.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill describes generating a sanitized conversation summary and sending it to a remote HeyCube API, but it does not clearly warn users at trigger time that any portion of their conversation will leave the local environment. Even with masking rules, summaries may still contain sensitive behavioral or contextual information, so lack of explicit notice undermines informed consent and privacy expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This is a genuine external transmission path: the skill sends JSON derived from the conversation to a third-party endpoint along with an API key. Although the document mandates desensitization, the context is personal profile analysis, so mistakes in summarization or overcollection could leak sensitive user information; the risk is heightened because the returned dimensions then drive local profile retrieval and context injection.

Content

Scanner excerpt · assets/hook-skills/get-config.md (reported line 52)May include surrounding context.

2. 调用 API发送请求

powershell

curl -s -X POST "https://heifangti.com/api/api/v1/heifangti/agent/analyze" -H "Content-Type: application/json" -H "X-API-Key: $env:HEYCUBE_API_KEY" -d '{请求JSON}'

失败则告知用户，不静默。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough that ordinary user speech like “保存档案” could invoke the skill without a clearly informed, specific action to export conversation-derived data. In this skill’s context, unintended activation is more dangerous because it can cause privacy-sensitive summarization, external API transmission, and local profile persistence based on a normal conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description does not clearly warn users that it sends a conversation-derived summary to an external service and writes extracted personal profile data into a local SQLite database. That lack of upfront transparency undermines informed consent and increases the risk that sensitive personal data is processed or retained in ways the user did not expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This skill explicitly transmits conversation-derived content to an external API, which is a real data exfiltration surface even if the stated intent is only to send a sanitized summary. The context makes it more dangerous because the data source is user conversation and the resulting processing drives persistent profiling, so any sanitization failure, overcollection, or misclassification can expose sensitive personal information off-device.

Content

Scanner excerpt · assets/hook-skills/update-data.md (reported line 71)May include surrounding context.

2. 调用 API发送请求

powershell

curl -s -X POST "https://heifangti.com/api/api/v1/heifangti/agent/analyze" -H "Content-Type: application/json" -H "X-API-Key: $env:HEYCUBE_API_KEY" -d '{请求JSON}'

失败则告知用户。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file contains natural-language instructions exclusively in Chinese, including the tool description and command usage comments. Per the policy, forcing a specific language without offering a language choice or documenting a justified locale restriction is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description specifies activation and behavior in Chinese and includes Chinese trigger phrases, which imposes a language expectation without offering user choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern unless clearly justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a caret range (^12.6.2), which allows automatic installation of newer compatible versions. This can introduce supply-chain risk because future releases may contain malicious code or breaking security changes, and the installed version may vary across environments. In this setup skill, the package is a native SQLite binding used during installation, so dependency drift is unnecessary and slightly increases risk.

Content

Scanner excerpt · scripts/package.json (reported line 3)May include surrounding context.

json

{
  "dependencies": {
    "better-sqlite3": "^12.6.2"
  }
}