Heartbeat Checklist

• Outcome: Review
• Latest audit: May 28, 2026 at 7:40 AM UTC
• Version:
  1.0.0

Overview

The skill is not clearly malicious, but it gives a heartbeat agent potentially disruptive cleanup and system-management authority without enough user control.

Review before installing. Use it only in report-only mode unless you add explicit approval for closing apps, changing browser tabs, deleting or trashing files, and starting, stopping, or enabling system services. Confirm what the Hydra daemon and resource-monitor.timer are on your machine before allowing any action against them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The checklist authorizes potentially disruptive or destructive housekeeping actions such as closing apps, cleaning tabs, and moving screenshots to trash without requiring user confirmation or warning about impact. In an autonomous agent context, these actions can cause data loss, interrupt active work, or remove evidence/artifacts the user intended to keep.

VirusTotal

61/61 vendors flagged this skill as clean.