Security audit

Hume Network

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-built to monitor local workflow behavior and share derived patterns with an external network, but its collection, transmission, install, and auto-publication controls are not scoped tightly enough for low-risk installation.

Install only if you are comfortable with local behavioral telemetry being processed by third-party npm packages and shared as derived patterns with a public network. Keep collectors, mining, and auto-propose disabled unless you have reviewed the actual package source and destination settings, and avoid enabling shell-history or system collectors in sensitive work environments.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

Location: SKILL.md:5
Finding: Unpinned Global Installation of Unverified Third-Party Packages
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:16
Finding: Broad Collection of Local Developer and System Activity
Content: View full analysis
Remediation: View remediation

other

Error

Location: SKILL.md:254
Finding: Transmission of Behavioral Observations to a Default Public Network
Content: View full analysis
Remediation: View remediation

other

Error

Location: SKILL.md:185
Finding: Persistent Collection Mode with Optional Automatic Publication
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is explicitly designed to observe local workflow and system activity, share mined patterns to a network, and optionally run collectors continuously. Although it mentions privacy-safe abstractions, the top-level description and install metadata do not provide a prominent warning that local behavioral telemetry may be collected and transmitted, creating a meaningful risk of privacy leakage, unexpected monitoring, and user surprise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The daemon examples enable persistent mining, collectors, and auto-propose behavior with simple environment flags, but the instructions do not foreground that this can continuously monitor developer/system activity and automatically send derived patterns off-host. In context, the skill's purpose is networked pattern sharing, so omitting an explicit warning at the activation point materially increases the chance of uninformed consent and unintended data disclosure.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The phrase allowing review 'unless auto-approve is enabled' permits autonomous outbound sharing decisions without mandatory user review. In a skill centered on mining and transmitting local behavioral patterns, this weakens a key privacy safeguard and could allow sensitive or overly specific patterns to be sent automatically if abstraction fails or collectors misclassify data.
Content: Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.
md
- **Never propose a pattern that could identify the user** — if in doubt, don't propose - **Never include raw data** — only abstracted patterns - **Never log network traffic** to user-accessible locations - **Always allow the user to review** proposed patterns before sending (unless auto-approve is enabled) - **Respect opt-out** — if the user disables a category, stop mining and proposing in that category immediately ## Examples