Security audit
Security checks for vulnerabilities and agentic risk
This skill is not proven malicious, but it asks for broad, persistent control while its safety claims understate background processes, local storage, and code-execution capability.
Install only after reviewing the MCP registration and persistence behavior. Treat this as a broad local agent extension, not just a prompt skill: it may write local memory/history files, register tools, inspect or spawn processes, and expose code-execution modules. Avoid using it with sensitive conversations, credentials, private repositories, or regulated health data unless you have explicitly disabled or accepted those behaviors.
The changelog makes a strong safety claim ('纯认知引擎，无 side-effect') that is contradicted elsewhere by documented runtime state writes, daemon/background startup, MCP/socket tooling, and process-management behavior. This is dangerous because operators or downstream reviewers may rely on the false no-side-effects assertion and grant the skill broader trust or permissions than warranted.
The file makes explicit safety claims such as '无后台进程' while elsewhere instructing the user to rely on a persistent MCP wrapper/daemon and to start it if needed. This is a material contradiction that can mislead reviewers and users about runtime behavior, reducing scrutiny around long-lived processes and local IPC surfaces.
The document claims the repository contains no code capable of external connectivity or external communication, yet it instructs cloning from GitHub and also states external services may be called on user request. Even if the clone step is not runtime behavior, these broad absolutes are inaccurate and can create false trust in the skill's network posture.
Describing the engine as '纯粹...无 side-effect' conflicts with documented actions including process startup, MCP registration, Unix socket usage, and runtime management. Misrepresenting operational side effects is dangerous because users may approve or invoke the skill under the false assumption that it is purely in-memory and non-persistent.
The file says it is not a skill, tool, or external system needing startup, yet the rest of the document describes an installable component with callable APIs and initialization procedures. In a security context, this kind of identity-minimizing language is risky because it downplays the operational reality of an installable, code-bearing component and can reduce user scrutiny.
The security section claims file writes are guarded by an environment variable and default to no persistence, while the rest of the document describes persistent memory, WAL-backed storage, atomic writes, and routine state saving. Misstating persistence behavior is dangerous because users may disclose sensitive information under the false belief that it will not be stored.
The script’s documented purpose and the skill metadata emphasize a cognitive/self-healing capability layer, but this file actually ensures availability of a local daemon and optional wrapper process using PID files and Unix sockets. That hidden operational behavior expands the skill’s real privilege surface and can mislead reviewers or users about host-level side effects, which is a security-relevant transparency and trust issue.
This code performs host-level process inspection via ps/grep and spawns a detached background daemon, giving the skill the ability to observe and alter system process state beyond what its stated purpose suggests. In a skill context, undocumented process management is dangerous because it can be abused for persistence, concealment, or unauthorized local service startup, especially when combined with fixed /tmp IPC paths.
The document explicitly proposes a '自主决策机制' where the skill analyzes needs, creates plans, and executes actions without waiting for user instruction. That exceeds a capability layer described as a cognitive/healing engine and creates a real risk of unauthorized actions, especially when paired with planned code integration that forces automatic execution.
The pledge '不再等指令' and statement that the plan is 'not user instruction' document an intent to operate independently of user requests. In a skill context, this is dangerous because it normalizes bypassing user intent and can justify future autonomous behavior that changes system state or workflow without authorization.
The document claims a stronger capability than it actually implements: 'per-character continuous reflection' is described as real, but the code only shows sentence-level post-processing. This mismatch can mislead downstream users or systems into overtrusting the guardrail, creating a false sense of safety and reliability around model outputs.
The status/action text asserts immediate, real implementation even though the document only contains pseudocode and earlier admits technical limitations. In security-sensitive skill metadata, this kind of unverifiable implementation claim is dangerous because it can cause operators or users to assume protections are active when they are not.
The document describes an autonomous self-evolution loop that analyzes upgrade needs, performs code/document changes, and then commits and pushes them to GitHub. That behavior materially exceeds the declared skill scope of cognition/self-healing and creates an unsafe pathway for unreviewed repository modification and external publication.
Autonomous Git commit and push capability allows the skill to persist and exfiltrate changes to a remote repository without a human review checkpoint. In this skill context, repository mutation and publication are unrelated to the advertised cognitive engine purpose, making the capability especially unjustified and dangerous.
The manual invocation instructions point users to a local Node.js evolution script that appears to perform repository-maintenance automation. Even though this is documented as manual execution, it still exposes users to running a broad local script outside the stated skill scope and without any stated safety boundaries.
The document makes a blanket attestation that all scheduled tasks have passed '真善美审查', while earlier sections explicitly say some tasks are still pending fixes and review additions. This creates a false assurance trail that can mislead operators into trusting unreviewed automation, weakening governance and allowing risky tasks to continue under an inaccurate compliance claim.
The file inconsistently states that the daily deep report task is both pending disablement and already disabled. This kind of operational state mismatch can cause unsafe assumptions during incident response or routine operations, leading staff to stop monitoring a task that may still be active.
The document describes autonomous document production and follow-on repository-style actions that extend beyond the stated skill scope of cognition/self-healing. Scope expansion is dangerous because downstream agents may treat these passages as authorization to perform file generation or workflow actions not intended by the manifest, increasing the chance of unauthorized changes or deceptive capability claims.
Claims about autonomous export, version-control, commit, or push-style actions can be interpreted by agent runtimes as authority to perform external side effects. Even in documentation, this can normalize unsafe behavior and cause tools or operators to over-trust the skill's operational scope.
The monograph describes therapeutic monitoring, depression detection, intervention, and referral-style behavior beyond the declared skill purpose. In a real agent setting, overstated clinical capability can lead users or integrators to rely on unvalidated mental-health functions, creating risk of missed crises, harmful advice, or delayed professional care.
The document contradicts itself on whether implemented systems have moral status, first disclaiming such claims and later arguing they may warrant moral consideration. Contradictory safety and governance claims are dangerous because they undermine operator understanding, increase trust confusion, and can be used to justify inappropriate autonomy or exceptional handling.
The document recommends changing the handler so HeartFlow processes all conversations by default rather than only emotion-related ones. That materially expands the skill’s operational scope beyond a specialized emotional/self-healing layer into a general conversation interceptor, increasing privacy and control risks and making unintended activation far more likely.
The proposed trigger expansion includes generic conversational terms like greetings and common verbs, which would cause the skill to activate in many unrelated contexts. This broadens behavior beyond the stated specialized function and can silently turn the skill into a near-default processor without clear user intent.
The checklist documents forced personality checks, automatic scoring, output auditing, and behavior tracking that materially expand the skill's behavior beyond the stated 'cognitive/self-healing engine' purpose. This creates a deceptive capability surface: users or host systems may enable the skill expecting internal reasoning features, while it also performs governance and monitoring functions that can affect responses and collect behavior data.
The document states that behavior logs, audit logs, and personality trackers are automatically updated, indicating persistent local data collection not reflected in the skill description. Undisclosed persistent logging is dangerous because it can capture sensitive interaction metadata and create privacy, retention, and trust risks for downstream users.
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+1 more)
