Mark Heartflow Skill

• Outcome: Review
• Latest audit: Jun 17, 2026 · 7:11 PM UTC
• Version: 3.0.0

Overview

HeartFlow is a real AI cognition and memory skill, but it also exposes broad local execution, persistence, and unauthenticated local service capabilities that need review before installation.

Install only if you intentionally want a broad local AI cognition framework with persistent memory and local tool surfaces. Review and restrict MCP HTTP access, disable or avoid code execution routes unless needed, treat memory injection as prompt-affecting behavior, and inspect/delete local memory and behavior-tracking files regularly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (204)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises capabilities including environment-variable access, file read/write, network access, and shell execution, but does not declare permissions or provide a formal capability boundary. That creates a transparency and policy-enforcement gap: a host may load the skill without understanding the effective access it requires, increasing the chance of over-privileged execution and unsafe deployment.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The plan expands the skill from an internal reflection/cognition aid into a user↔LLM mediation layer that directly orchestrates model calls. That materially changes the trust boundary, data flow, and effective privileges of the skill, creating a capability mismatch that can expose users to unintended prompting, routing, or policy-bypassing behavior if not explicitly disclosed and constrained.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: Introducing direct LLM API calling without reflecting that behavior in the manifest undermines informed consent and reviewability. Users and platform operators may believe the skill is only an internal cognitive engine while it actually forwards user/context data to a model and performs external orchestration.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: Persona injection, stance detection, and value-driven commentary move the skill from neutral assistance into opinionated modification of user-visible responses. In a mediation layer, this can manipulate framing, suppress alternatives, or blur the line between model output and the skill author's imposed viewpoint, especially when users are not clearly told such rewriting is occurring.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: A response interceptor that alters LLM output with the skill's own judgment creates a powerful content-control point. Without strict policy, auditability, and disclosure, it can silently distort answers, remove safety-critical caveats, or inject additional instructions, making this more dangerous in a skill explicitly designed to mediate between users and the model.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documented `hf_judge.js` flow calls `shouldBeSilent(input)` with a raw string even though the updated function expects a context object. This mismatch can silently break crisis-evaluation logic, producing incorrect judgments during safety-sensitive scenarios and undermining the claimed four-step guardrail.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The CLI executes a separate local Node script during the bundle flow, which expands the skill's execution surface beyond the declared in-process cognitive engine behavior. Although the invocation uses a fixed path, no shell, and a timeout, it still permits side-effectful code execution from an auxiliary script that could read/write data or perform other actions not obvious from the CLI interface.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file exposes a long-lived HTTP/SSE service with a JSON-RPC POST endpoint and permissive CORS, substantially expanding the skill from local cognition logic into a network-accessible service surface. Even though it binds to 127.0.0.1, any local process or browser context can interact with it, increasing attack surface for unauthorized tool invocation, data access, and misuse of memory or bridge capabilities.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script's comment claims lastAccessed is updated only in debug mode, but the code updates timestamps and saves the learned store unconditionally. This creates hidden state changes during what appears to be a read/format operation, weakening auditability and allowing prompt-generation runs to silently mutate retention metadata.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The header and usage describe the script as producing text for prompt injection, but it also mutates the learned memory store and writes an extra file. In a skill that feeds output into a system prompt, hidden persistence is risky because operators may treat the script as a pure formatter while it actually alters long-term memory state and creates additional artifacts.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module persists detailed behavioral goal data, notes, timestamps, and progress history to local disk, creating a privacy-sensitive datastore that exceeds the stated 'cognitive/self-reflection' scope in the skill metadata. Scope expansion into durable user tracking increases the risk of unintended collection, retention, and later exposure of sensitive personal habit or mental-health-adjacent information, especially because there is no consent, retention policy, access control, or encryption visible here.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file implements a substantial goal-management and behavioral analytics subsystem that is materially broader than the declared philosophy/reflection engine. Even if not directly exploitable as code execution, this mismatch is security-relevant because hidden or under-disclosed functionality can collect and process sensitive user data in ways users and integrators do not expect, undermining trust and informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The module claims to assess internal psychological state, but it also persists interaction-derived patterns in a knowledge cache and histories. In an agent setting, that can silently retain user-provided or sensitive content beyond the immediate task boundary, expanding the data retention surface and creating privacy and cross-session contamination risks.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: `safePath` claims to enforce file path safety, but it only checks for a few hardcoded substrings. An attacker can bypass it with many dangerous paths not on the list, including other absolute paths, traversal sequences, platform-specific paths, symlinks, or encoded variants, so downstream code may wrongly trust unsafe file access as validated.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: `noDangerousChars` is presented as injection protection, but a simple character blacklist is not a safe defense against injection. Attackers can exploit context-specific parsing rules, alternate encodings, Unicode variants, logic flaws, or injection vectors that do not require these exact characters, leading developers to overtrust the check and omit proper output encoding or parameterization.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The engine persists raw user input, full layer outputs, and reasoning-like traces in memory and then exposes them through accessor/debug APIs. In a cognitive/reflection skill, these artifacts are especially sensitive because they may contain intimate personal content, inferred concepts, emotions, and generated internal analysis that other callers or components could later retrieve.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This is a real logic flaw in the compaction path. In `TrimStrategy.compress`, the code calls `tokenizer.estimate(msg)` on a message object rather than estimating `msg.content` or using `estimateMessages`, so the tokenizer returns 0 for object inputs and the max-token guard is bypassed for non-system messages. That can cause the engine to retain more content than intended, fail to actually compact oversized context, and produce inconsistent memory-trimming behavior in an agent component that is supposed to enforce context limits.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The constructor immediately starts a background timer, causing autonomous behavior as soon as the module is instantiated. In an agent skill described as a cognitive/reflection component, hidden self-starting execution increases attack surface, creates resource-consumption risk, and can trigger ongoing state mutation or logging without explicit caller consent.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The comments describe suggestion-only self-correction, but tick() invokes _applyCorrections() to mutate internal state automatically. That mismatch is dangerous because integrators may trust the module as observational/diagnostic while it actually performs autonomous behavior changes, which can alter agent behavior in opaque ways and undermine safety review assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This code mines memory logs for interruption, frustration, and confusion patterns, then generates goals to optimize user emotional response and behavioral recovery. That goes beyond narrow self-reflection and creates implicit profiling of user behavior, which is risky if users did not explicitly consent to this analysis or if the feature is enabled in production.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The engine persists autonomy traces and failure memory to disk under the project root, creating local records of goals, failures, and execution state that exceed the stated introspective role. Even with debug gating for some reads and redaction in trace saving, failure-memory writes are still active and can capture sensitive project metadata without clear consent, increasing privacy and data-handling risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The PDCA engine performs autonomous repository inspection by reading logs, listing files in log directories, and enumerating test files under the project root. In a skill described as reflective/psychological, this broad local inspection is more dangerous because it silently expands from cognition features into filesystem reconnaissance, which may expose sensitive repository structure or log contents to later components.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This module performs persistent local logging and log retrieval to a JSONL file, which expands its behavior from internal cognition/state tracking into durable data retention. Even though writes are gated behind HEARTFLOW_DEBUG and capped at about 1MB, the feature can still store operational metadata on disk without clear minimization, retention, or access controls, which creates privacy and data exposure risk if debug mode is enabled in production or by another component.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This code performs sensitive psychological and parenting profiling, including speculative intergenerational-trauma-style inferences, based on keyword matching in user text. Even with disclaimers, the module generates personalized mental-health-adjacent conclusions without clear necessity, explicit consent, or reliable qualification, which can cause harmful misclassification, manipulation of vulnerable users, or inappropriate guidance in family situations.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: The transparency report misrepresents runtime behavior by returning the parenting reflection protocol IDs under a field named as if it indicates whether the feature was triggered. This can mislead downstream systems, auditors, or users about when sensitive profiling logic actually ran, undermining oversight and consent controls around a high-sensitivity feature.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code-engine.js:68

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code-verifier.js:385

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code/code-executor.js:571

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/proactive/self-initiator.js:896

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code-engine.js:1586

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code-verifier.js:366

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code/code-executor.js:481

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/proactive/self-initiator.js:484

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/core/search/hybrid-search.js:51

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/core/search/hybrid-search.js:421

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: src/utils/atomic-write.js:139