Security audit

Mark Heartflow Skill

Security checks for vulnerabilities and agentic risk

Overview

HeartFlow is a real AI cognition and memory skill, but it also exposes broad local execution, persistence, and unauthenticated local service capabilities that need review before installation.

Install only if you intentionally want a broad local AI cognition framework with persistent memory and local tool surfaces. Review and restrict MCP HTTP access, disable or avoid code execution routes unless needed, treat memory injection as prompt-affecting behavior, and inspect/delete local memory and behavior-tracking files regularly.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (204)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises capabilities including environment-variable access, file read/write, network access, and shell execution, but does not declare permissions or provide a formal capability boundary. That creates a transparency and policy-enforcement gap: a host may load the skill without understanding the effective access it requires, increasing the chance of over-privileged execution and unsafe deployment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The plan expands the skill from an internal reflection/cognition aid into a user↔LLM mediation layer that directly orchestrates model calls. That materially changes the trust boundary, data flow, and effective privileges of the skill, creating a capability mismatch that can expose users to unintended prompting, routing, or policy-bypassing behavior if not explicitly disclosed and constrained.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Introducing direct LLM API calling without reflecting that behavior in the manifest undermines informed consent and reviewability. Users and platform operators may believe the skill is only an internal cognitive engine while it actually forwards user/context data to a model and performs external orchestration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Persona injection, stance detection, and value-driven commentary move the skill from neutral assistance into opinionated modification of user-visible responses. In a mediation layer, this can manipulate framing, suppress alternatives, or blur the line between model output and the skill author's imposed viewpoint, especially when users are not clearly told such rewriting is occurring.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: A response interceptor that alters LLM output with the skill's own judgment creates a powerful content-control point. Without strict policy, auditability, and disclosure, it can silently distort answers, remove safety-critical caveats, or inject additional instructions, making this more dangerous in a skill explicitly designed to mediate between users and the model.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented hf_judge.js flow calls shouldBeSilent(input) with a raw string even though the updated function expects a context object. This mismatch can silently break crisis-evaluation logic, producing incorrect judgments during safety-sensitive scenarios and undermining the claimed four-step guardrail.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The CLI executes a separate local Node script during the bundle flow, which expands the skill's execution surface beyond the declared in-process cognitive engine behavior. Although the invocation uses a fixed path, no shell, and a timeout, it still permits side-effectful code execution from an auxiliary script that could read/write data or perform other actions not obvious from the CLI interface.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file exposes a long-lived HTTP/SSE service with a JSON-RPC POST endpoint and permissive CORS, substantially expanding the skill from local cognition logic into a network-accessible service surface. Even though it binds to 127.0.0.1, any local process or browser context can interact with it, increasing attack surface for unauthorized tool invocation, data access, and misuse of memory or bridge capabilities.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's comment claims lastAccessed is updated only in debug mode, but the code updates timestamps and saves the learned store unconditionally. This creates hidden state changes during what appears to be a read/format operation, weakening auditability and allowing prompt-generation runs to silently mutate retention metadata.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The header and usage describe the script as producing text for prompt injection, but it also mutates the learned memory store and writes an extra file. In a skill that feeds output into a system prompt, hidden persistence is risky because operators may treat the script as a pure formatter while it actually alters long-term memory state and creates additional artifacts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This module persists detailed behavioral goal data, notes, timestamps, and progress history to local disk, creating a privacy-sensitive datastore that exceeds the stated 'cognitive/self-reflection' scope in the skill metadata. Scope expansion into durable user tracking increases the risk of unintended collection, retention, and later exposure of sensitive personal habit or mental-health-adjacent information, especially because there is no consent, retention policy, access control, or encryption visible here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file implements a substantial goal-management and behavioral analytics subsystem that is materially broader than the declared philosophy/reflection engine. Even if not directly exploitable as code execution, this mismatch is security-relevant because hidden or under-disclosed functionality can collect and process sensitive user data in ways users and integrators do not expect, undermining trust and informed consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The module claims to assess internal psychological state, but it also persists interaction-derived patterns in a knowledge cache and histories. In an agent setting, that can silently retain user-provided or sensitive content beyond the immediate task boundary, expanding the data retention surface and creating privacy and cross-session contamination risks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: safePath claims to enforce file path safety, but it only checks for a few hardcoded substrings. An attacker can bypass it with many dangerous paths not on the list, including other absolute paths, traversal sequences, platform-specific paths, symlinks, or encoded variants, so downstream code may wrongly trust unsafe file access as validated.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: noDangerousChars is presented as injection protection, but a simple character blacklist is not a safe defense against injection. Attackers can exploit context-specific parsing rules, alternate encodings, Unicode variants, logic flaws, or injection vectors that do not require these exact characters, leading developers to overtrust the check and omit proper output encoding or parameterization.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The engine persists raw user input, full layer outputs, and reasoning-like traces in memory and then exposes them through accessor/debug APIs. In a cognitive/reflection skill, these artifacts are especially sensitive because they may contain intimate personal content, inferred concepts, emotions, and generated internal analysis that other callers or components could later retrieve.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This is a real logic flaw in the compaction path. In TrimStrategy.compress, the code calls tokenizer.estimate(msg) on a message object rather than estimating msg.content or using estimateMessages, so the tokenizer returns 0 for object inputs and the max-token guard is bypassed for non-system messages. That can cause the engine to retain more content than intended, fail to actually compact oversized context, and produce inconsistent memory-trimming behavior in an agent component that is supposed to enforce context limits.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The constructor immediately starts a background timer, causing autonomous behavior as soon as the module is instantiated. In an agent skill described as a cognitive/reflection component, hidden self-starting execution increases attack surface, creates resource-consumption risk, and can trigger ongoing state mutation or logging without explicit caller consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comments describe suggestion-only self-correction, but tick() invokes _applyCorrections() to mutate internal state automatically. That mismatch is dangerous because integrators may trust the module as observational/diagnostic while it actually performs autonomous behavior changes, which can alter agent behavior in opaque ways and undermine safety review assumptions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code mines memory logs for interruption, frustration, and confusion patterns, then generates goals to optimize user emotional response and behavioral recovery. That goes beyond narrow self-reflection and creates implicit profiling of user behavior, which is risky if users did not explicitly consent to this analysis or if the feature is enabled in production.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The engine persists autonomy traces and failure memory to disk under the project root, creating local records of goals, failures, and execution state that exceed the stated introspective role. Even with debug gating for some reads and redaction in trace saving, failure-memory writes are still active and can capture sensitive project metadata without clear consent, increasing privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The PDCA engine performs autonomous repository inspection by reading logs, listing files in log directories, and enumerating test files under the project root. In a skill described as reflective/psychological, this broad local inspection is more dangerous because it silently expands from cognition features into filesystem reconnaissance, which may expose sensitive repository structure or log contents to later components.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This module performs persistent local logging and log retrieval to a JSONL file, which expands its behavior from internal cognition/state tracking into durable data retention. Even though writes are gated behind HEARTFLOW_DEBUG and capped at about 1MB, the feature can still store operational metadata on disk without clear minimization, retention, or access controls, which creates privacy and data exposure risk if debug mode is enabled in production or by another component.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code performs sensitive psychological and parenting profiling, including speculative intergenerational-trauma-style inferences, based on keyword matching in user text. Even with disclaimers, the module generates personalized mental-health-adjacent conclusions without clear necessity, explicit consent, or reliable qualification, which can cause harmful misclassification, manipulation of vulnerable users, or inappropriate guidance in family situations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The transparency report misrepresents runtime behavior by returning the parenting reflection protocol IDs under a field named as if it indicates whether the feature was triggered. This can mislead downstream systems, auditors, or users about when sensitive profiling logic actually ran, undermining oversight and consent controls around a high-sensitivity feature.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/code-engine.js:68

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/code-verifier.js:385

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/code/code-executor.js:571

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/proactive/self-initiator.js:896

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/code-engine.js:1586

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/code-verifier.js:366

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/code/code-executor.js:481

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/proactive/self-initiator.js:484

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/core/search/hybrid-search.js:51

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/core/search/hybrid-search.js:421

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: src/utils/atomic-write.js:139