Security audit

Heartbeats

Security checks across malware telemetry and agentic risk

Overview

The skill is instruction-only and not clearly malicious, but it grants broad unattended authority to inspect private/workspace data, rewrite memory files, and commit or push repository changes.

Install only if you intentionally want proactive unattended agent behavior. Before using it, restrict which accounts and files the agent may inspect, require explicit approval before any commit, push, deletion, or long-term memory update, and periodically review HEARTBEAT.md, MEMORY.md, and memory/heartbeat-state.json for unintended changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill explicitly authorizes committing and pushing changes as part of heartbeat-driven proactive work, which exceeds the legitimate scope of a heartbeat/memory-maintenance helper. Allowing automatic source-control writes and remote publication creates a path for unintended code, secrets, or prompt-derived changes to be persisted and exfiltrated without explicit user approval.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation language is broad: any heartbeat poll triggers reading HEARTBEAT.md and following it strictly, with little constraint on what tasks may be performed. That makes the skill susceptible to over-broad autonomous action, especially if HEARTBEAT.md contains risky or stale instructions, and increases the chance of unintended operations during routine polling.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill tells the agent it is free to edit HEARTBEAT.md autonomously, but does not warn the user that heartbeat handling may modify workspace files. Silent file edits during background execution can alter task instructions, create persistence, and make later agent behavior harder to audit or predict.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documented state tracking in memory/heartbeat-state.json introduces persistent writes as part of routine heartbeat activity without explicit user warning or consent. Even if the file only stores timestamps, background persistence can leak behavioral metadata, create hidden state, and affect future actions in ways the user may not expect.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Authorizing the agent to commit and push its own changes during proactive work enables repository modification and remote upload without explicit user warning or approval. In the context of heartbeat automation, this is especially dangerous because background polling could publish sensitive data, corrupt history, or deploy unintended changes with little oversight.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The memory-maintenance workflow instructs the agent to autonomously update and remove content from MEMORY.md, creating persistent edits without clear user warning. Because MEMORY.md may shape future behavior or preserve important context, unreviewed edits can introduce drift, erase useful information, or encode adversarial instructions for later runs.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.