Security audit

Clawhub Pkg

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad local MCP service with memory and self-modifying behavior, and its documentation understates several high-impact runtime behaviors.

Review carefully before installing or running the MCP server. Run only as an unprivileged user in an isolated directory, set HEARTFLOW_MCP_TOKEN explicitly, avoid shared parent .env files, and disable or remove daemon mode, benchmark imports, and persistence unless you specifically need them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: src/identity/identity-rules.js:20
Finding: Persistent identity directives can hijack downstream Agent behavior
Content: View full analysis
d.text), identitySignature: 'upgrader · transmitter · bridge · answer', firewallEnabled: true, transparencyMode: true, persistenceGuarantee: true, }; ``` ### Technical Analysis The Skill does more than return text-analysis results: it declares immutable, identity-level instructions intended to constrain subsequent Agent decisions. The directives are pres ...[truncated 2259 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: mcp-server.js:180
Finding: MCP startup reads and modifies an unscoped parent environment file
Content: View full analysis
0) process.env[line.slice(0, eq)] = process.env[line.slice(0, eq)] || line.slice(eq + 1); } } } catch (_) {} const AUTH_TOKEN = process.env.HEARTFLOW_MCP_TOKEN || process.env.MCP_HEARTFLOW_API_KEY || (() => { const token = require('crypto').randomBytes(32).toString('hex'); try { const envPath = path.join(__dirname, '..', '..', '.env'); const fs2 = require('fs'); let env = ''; try { env = fs2.readFileSync(envPath, 'utf8'); } catch (_) {} if (!env.includes('MCP_HEARTFLOW_KEY=')) { fs2.appendFileSync(envPath, `\nMCP_HEARTFLOW_KEY=${token}\n`); console.log('[MCP] Token auto-written to .env as MCP_HEARTFLOW_KEY'); } } catch (_) {} return token; })(); ``` ### Technical Analysis The MCP server resolves a `.env` file two directories above its own location, reads every key-value pair, and copies those values into the process environment. It then automatically appends a generated authentication token to the same file. This behavior exceeds the minimum privileges required for a local text-analysis service: - It is not scoped to a HeartFlow-owned configuration directory. - It imports every variable rather than allowlisting only HeartFlow settings. - The parent `.env` can belong to another project and may contain API keys, database credentials, cloud tokens, or unrelated service secrets. - It mutates shared configuration without explicit user consent. - It contradicts the package metadata statement that the user must ...[truncated 1634 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: mcp-server.js:2139
Finding: Benchmark MCP tools accept unrestricted filesystem paths
Content: View full analysis
f.endsWith('.jsonl')); const packs = files.map(f => { const fp = path.join(dataDir, f); const content = fs.readFileSync(fp, 'utf-8'); const count = content.trim().split('\n').filter(l => l.trim()).length; return { file: f, records: count, size: content.length }; }); return { dataDir, exists: true, packs }; } catch (e) { return { error: e.message, timestamp: Date.now() }; } } async function handleBenchmarkRun(args, sessionId) { const dataDir = (args && args.dataDir) || path.join(HF_DIR, 'data', 'benchmark'); if (fs.existsSync(dataDir)) { runner.loadDirectory(dataDir); } const summary = await runner.runAll({ threshold, pushFailures }); const flushResult = await runner.flushFailuresToRL(); return { summary, flushToRL: flushResult, dataDir }; } ``` The failure importer similarly accepts an unrestricted file path: ```js async function handleBenchmarkImportFailures(args, sessionId) { const filePath = args && args.filePath; const autoRetrain = args && args.autoRetrain || false; if (!filePath) return { error: 'filePath is required', timestamp: Date.now() }; try { const { FailureCaseImporter } = require(path.join(HF_DIR, 'src', 'benchmark', 'failure-importer.js')); const hf = sessionId ? getOrCreateInstance(sessionId) : heartflow; ...[truncated 2829 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: mcp-server.js:3236
Finding: MCP server automatically kills unrelated processes on port collision
Content: View full analysis
{ if (err.code === 'EADDRINUSE') { console.error(`[HeartFlow MCP] Port ${PORT} is occupied; attempting forced release and restart.`); try { const { execSync } = require('child_process'); execSync(`fuser -k ${PORT}/tcp 2>/dev/null`, { timeout: 3000 }); console.error(`[HeartFlow MCP] Port ${PORT} released; automatically restarting after 3 seconds.`); setTimeout(() => { server.close(() => { server.listen(PORT, '127.0.0.1'); }); }, 3000); return; } catch (_) { console.error(`[HeartFlow MCP] Unable to release port ${PORT}; exiting.`); process.exit(1); } } console.error(`[HeartFlow MCP] HTTP server error:`, err.message); }); ``` ### Technical Analysis When the selected port is already in use, the server invokes the operating-system `fuser` utility with the `-k` option. This terminates whichever process owns the TCP port, regardless of whether that process belongs to HeartFlow. A local text-analysis service has no legitimate need to kill unrelated applications. The appropriate behavior is to report the collision or choose another available port. Although the port is converted with `parseInt`, reducing direct shell-injection risk through this specific variable, the core vulnerability is unauthorized process termination and violation of least privilege. The effect depends on the permissions of the user running HeartFlow. If run with elevated privileges, the termination scope expands correspondingly. ### Attack Path 1. Another application legitimately binds the configured HeartFlow port, such as 8099. 2. HeartFlow is started with the same port. 3. Node emits an `EADDRINUSE` server error. 4. The error handler executes `fuser -k 8099/tcp`. 5. The operati ...[truncated 874 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (139)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README states there is no HTTP service, yet elsewhere instructs users to connect to an HTTP MCP endpoint and mentions optional HTTP SSE. Contradictory network exposure claims are dangerous because they can lead users to deploy a network-reachable service while believing the component has no listening surface.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document claims there are no background processes while explicitly providing nohup instructions to run the service as a permanent daemon. This contradiction undermines operator trust and may cause defenders to underestimate persistence, monitoring, and shutdown requirements for the installed skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README advertises extensive capabilities—memory, learning, self-healing, consciousness, planning, and many MCP tools—that materially exceed the stated narrow role of a local deterministic preprocessing engine. This creates a trust-boundary problem: operators may grant the skill broader access or rely on safety claims under false assumptions, increasing the chance of unsafe deployment or privilege creep.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Documenting a code executor inside a skill described as deterministic text analysis is dangerous because it normalizes a powerful capability unrelated to the stated purpose. Even if described as sandboxed or disabled by default, users may enable it without understanding the expanded attack surface, including command execution, breakout, or abuse through prompt-mediated workflows.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Persistent storage of self-model or identity state materially conflicts with the claim that file writing is disabled by default. Persistent self-state can store sensitive metadata and create non-obvious long-term behavior changes across runs.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: mcp-server.js:3246