ClawHub
Back to skill

Security audit

Aicoo Heartbeat

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent heartbeat automation tool, but it needs Review because its autonomous runs can access sensitive workspace data and its read-only tier is documented inconsistently with write-capable tools.

Review before installing. Use only if you trust Aicoo with the connected workspace data and API key, keep the default MESSAGES tier unless you are comfortable with autonomous state changes, and avoid external cron or loop scheduling until the write permissions and tier behavior are clearly documented.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill presents the MESSAGES tier as read-only, but elsewhere documents write-capable tools such as create_note and memory_write as available during heartbeat runs. This creates a dangerous permission-model mismatch: users or integrators may enable the feature believing it cannot mutate state, when it can still persist data or alter workspace content.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The internal design claims write-heavy tools are excluded, but the available tool list still includes write operations. That inconsistency weakens operator trust and can lead to unintended autonomous state changes, especially in a loop that runs periodically without per-action confirmation.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger list is broad and includes common phrases like 'heartbeat', 'run heartbeat', and 'agent background', increasing the chance of accidental invocation. Because this skill can initiate autonomous monitoring and potentially write-capable behavior, unintended activation can expose private workspace data or kick off background actions without clear user intent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill description does not prominently warn that heartbeat performs ongoing workspace monitoring and may operate in a write-capable ACTIONS tier. Missing consent and transparency around autonomous behavior is risky because users may not understand that background runs can inspect emails, calendars, notes, and tasks, and in some modes modify state.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.