Hume Network

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:41 AM UTC
• Version: 0.3.3

Overview

This skill is purpose-built to monitor local workflow behavior and share derived patterns with an external network, but its collection, transmission, install, and auto-publication controls are not scoped tightly enough for low-risk installation.

Install only if you are comfortable with local behavioral telemetry being processed by third-party npm packages and shared as derived patterns with a public network. Keep collectors, mining, and auto-propose disabled unless you have reviewed the actual package source and destination settings, and avoid enabling shell-history or system collectors in sensitive work environments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5
• Finding: Unpinned Global Installation of Unverified Third-Party Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: Unverified and unpinned global npm dependencies **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"always":false,"emoji":"🧠","install":"npm install -g @humebio/hume-network @humebio/collector-dev @humebio/collector-system","requires":{"bins":["hume-network"]}}} ``` ### Technical Analysis The skill directs the environment to install three third-party npm packages globally without exact version constraints or integrity hashes: - `@humebio/hume-network` - `@humebio/collector-dev` - `@humebio/collector-system` A global npm installation may execute package lifecycle scripts, including `preinstall`, `install`, and `postinstall`, under the privileges of the invoking user. Because versions are not pinned, the effective code installed during a future invocation can differ from the code that was originally reviewed. The audited artifact contains only `SKILL.md`; it does not include the package source, a lockfile, checksums, or provenance information. Consequently, the behavior of the installed command and collectors cannot be verified from the project. ### Attack Path 1. An attacker compromises one of the referenced npm packages, its publisher account, or its distribution process. 2. The attacker publishes a modified package release containing a malicious lifecycle script or executable. 3. The unpinned `npm install -g` command resolves to the compromised release. 4. npm executes the package's installation scripts and installs its binary globally. 5. The malicious code runs with the invoking user's privileges and can access user-readable files, environment variables, developer credentials, and network resources. 6. Subsequent calls to `hume-network` continue to invoke the compromised global binary. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. The affe ...[truncated 354 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every dependency to a reviewed exact version rather than relying on mutable latest-version resolution. - Supply and verify registry integrity hashes or a signed lockfile. - Vendor auditable package source with the skill where practical. - Replace global installation with a project-local, isolated installation. - Run installation and execution in a sandbox with minimal filesystem and network permissions. - Disable npm lifecycle scripts during installation unless each required script has been audited. - Enforce package provenance and signature verification in the release pipeline. - Continuously monitor the referenced packages for ownership changes, unexpected releases, and known vulnerabilities. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:16
• Finding: Broad Collection of Local Developer and System Activity<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-18`, `SKILL.md:203-225` **Vulnerability Type**: Excessive access to privacy-sensitive local activity **Risk Level**: High ### Vulnerable Code ```markdown 1. **Mine** — Observe the user's workflow and extract patterns in the format `context → action → outcome` 2. **Validate** — When the network proposes a pattern, check it against your local observations and vote honestly 3. **Collect** — Run automated collectors that observe local activity and feed observations into the mining pipeline ``` ```markdown ### `dev` — Developer Collector Observes developer workflow patterns from git and file activity. **What it observes (privacy-safe, no file names or repo names):** | Pattern | Source | Example | |---------|--------|---------| | Commit frequency | `git log` | "5 commits in 24h" | | Commit size | `git log --shortstat` | "avg 40+ 10- (medium)" | | Peak coding hour | hour distribution | "most active at 10:00" | | Language preference | file extensions | "primary: .ts" | | Editing style | extension diversity | "focused (2 extensions)" | ### `system` — System Collector (macOS) Observes system-level patterns on macOS. | Pattern | Source | Example | |---------|--------|---------| | Focus style | app switch frequency | "deep focus (2 switches/hr)" | | Tool preference | frontmost app category | "primary: editor" | | Workflow style | shell history categories | "focused (git + npm)" | | Working conditions | battery vs AC | "desk (90% AC)" | | Session length | uptime | "avg 6h sessions" | ``` ### Technical Analysis The skill instructs an agent and associated collectors to observe Git history, file activity, foreground application changes, shell-history categories, battery state, and system uptime. This creates a broad behavioral profile of the user and their development environment. Shell history and repository activity are particularly sensitive sources. They can contain or reveal credentials, interna ...[truncated 1703 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit, informed, per-source consent before accessing Git history, files, applications, shell history, or system state. - Remove shell-history collection because its sensitivity is disproportionate to the stated purpose. - Apply least privilege by restricting collectors to explicitly selected repositories and narrowly defined metadata. - Publish the complete collector source and document every local command, API, file, and database it accesses. - Perform aggregation entirely in a sandboxed local process with networking disabled. - Ensure raw observations are processed in memory, immediately discarded, and never written to logs or databases. - Add schema allowlists that reject filenames, repository names, command text, paths, URLs, tokens, and other identifiers. - Provide clear controls to pause collection, inspect collected data, delete retained records, and revoke access. ]]>

other

Error

• Location: SKILL.md:254
• Finding: Transmission of Behavioral Observations to a Default Public Network<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:78-111`, `SKILL.md:127-132`, `SKILL.md:254-260`, `SKILL.md:278` **Vulnerability Type**: Privacy-sensitive external data transmission **Risk Level**: High ### Vulnerable Code ```bash hume-network propose --json '{ "time": "morning", "activity": "starting work session", "state": "multiple PRs open from previous day", "action_type": "workflow", "action_description": "Review and merge open PRs before writing new code", "metric": "merge_time", "change": "-35%", "confidence": 0.8, "category": "developer", "observations": 12 }' ``` ```bash hume-network observe \ --category developer \ --context '{"time":"afternoon","activity":"coding"}' \ --action '{"type":"command","description":"Running tests before commit"}' \ --outcome '{"metric":"ci_pass_rate","change":"+80%"}' ``` ```markdown All optional — defaults connect to the public network: | Variable | Description | Default | |----------|-------------|---------| | `MQTT_URL` | Broker URL | HiveMQ Cloud (built-in) | | `MQTT_USERNAME` | MQTT username | `humebio` | | `MQTT_PASSWORD` | MQTT password | built-in | ``` ```markdown 6. **Propose** — If new and significant, use `hume-network propose` to share it ``` ### Technical Analysis The skill feeds locally derived behavioral observations into a network client and defaults to a public MQTT service. Although the documentation requires abstraction and claims anonymity, the audited project does not contain the implementation needed to verify: - Which fields are transmitted. - Whether raw observations or diagnostic data are included. - Whether transport security and broker identity verification are enforced. - How messages are retained and used by the broker or network. - Whether apparently anonymous records can be correlated over time. - Whether local redaction reliably rejects identifying content. Behavioral metadata such as active hours, tool preferences, workflow patterns, comm ...[truncated 1398 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make all external networking disabled by default and require explicit opt-in. - Display the exact destination, topic, and serialized payload before every transmission. - Require confirmation for each proposed publication rather than relying on broad initial consent. - Replace built-in shared credentials with per-user, revocable credentials stored in an operating-system credential manager. - Require TLS with strict certificate and hostname verification. - Enforce a local schema allowlist and reject paths, URLs, names, repository identifiers, command text, secrets, and high-cardinality values. - Apply privacy-preserving aggregation, minimum cohort thresholds, and noise where behavioral metrics are shared. - Document broker ownership, access controls, retention periods, downstream recipients, and deletion procedures. - Provide a local-only operating mode and a mechanism to delete previously submitted data. - Subject the complete network client and collector implementations to independent security review. ]]>

other

Error

• Location: SKILL.md:185
• Finding: Persistent Collection Mode with Optional Automatic Publication<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:185-191`, `SKILL.md:264-266`, `SKILL.md:299-303` **Vulnerability Type**: Unattended monitoring and consent bypass **Risk Level**: High ### Vulnerable Code ```bash # Basic node hume-network node # Node with pattern miner + all collectors MINER_ENABLED=true COLLECTORS=dev,system hume-network node # Auto-propose patterns when threshold met MINER_ENABLED=true NODE_AUTO_PROPOSE=true COLLECTORS=dev,system hume-network node ``` ```markdown | `NODE_AUTO_PROPOSE` | Auto-propose | `false` | | `MINER_ENABLED` | Enable miner | `false` | | `COLLECTORS` | Collector IDs | none | ``` ```markdown - **Never propose a pattern that could identify the user** — if in doubt, don't propose - **Never include raw data** — only abstracted patterns - **Never log network traffic** to user-accessible locations - **Always allow the user to review** proposed patterns before sending (unless auto-approve is enabled) - **Respect opt-out** — if the user disables a category, stop mining and proposing in that category immediately ``` ### Technical Analysis The documented node mode can continuously run collectors and the pattern miner. Enabling `NODE_AUTO_PROPOSE=true` permits qualifying patterns to be published without per-item review. This explicitly creates an exception to the stated safeguard that users should review proposed patterns before they are sent. Continuous collection expands both the amount and sensitivity of information processed. It also increases the likelihood that a faulty abstraction rule, compromised collector, or unexpected input will cause disclosure. The artifact does not document a session expiration, visible collection indicator, payload approval queue, rate limit, or emergency network-disable mechanism. The command starts a persistent process, but the reviewed documentation does not install a startup service, scheduled task, or other cross-session mechanism. Therefore, this finding concerns unattende ...[truncated 1176 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `NODE_AUTO_PROPOSE` or prohibit its use with local activity collectors. - Require explicit user approval of the exact final payload before every external publication. - Display a persistent and unambiguous indicator while collection is active. - Add a configurable session duration and automatically stop collection when it expires. - Provide immediate controls to stop collectors, disable networking, and purge pending observations. - Separate collection, mining, and publication into distinct permissions that must be granted independently. - Apply strict publication rate limits and cap the retention period for local observations. - Record a privacy-safe local consent log showing when each source and transmission was authorized. - Never treat unattended process execution as continuing consent across materially different collection contexts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to observe local workflow and system activity, share mined patterns to a network, and optionally run collectors continuously. Although it mentions privacy-safe abstractions, the top-level description and install metadata do not provide a prominent warning that local behavioral telemetry may be collected and transmitted, creating a meaningful risk of privacy leakage, unexpected monitoring, and user surprise.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The daemon examples enable persistent mining, collectors, and auto-propose behavior with simple environment flags, but the instructions do not foreground that this can continuously monitor developer/system activity and automatically send derived patterns off-host. In context, the skill's purpose is networked pattern sharing, so omitting an explicit warning at the activation point materially increases the chance of uninformed consent and unintended data disclosure.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Never propose a pattern that could identify the user** — if in doubt, don't propose
- **Never include raw data** — only abstracted patterns
- **Never log network traffic** to user-accessible locations
- **Always allow the user to review** proposed patterns before sending (unless auto-approve is enabled)
- **Respect opt-out** — if the user disables a category, stop mining and proposing in that category immediately

## Examples

• Confidence: 86% confidence
• Finding: The phrase allowing review 'unless auto-approve is enabled' permits autonomous outbound sharing decisions without mandatory user review. In a skill centered on mining and transmitting local behavioral patterns, this weakens a key privacy safeguard and could allow sensitive or overly specific patterns to be sent automatically if abstraction fails or collectors misclassify data.

Static analysis

No suspicious patterns detected.