Security audit

Mark Heartflow Skill

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent AI memory/reflection purpose, but it also exposes under-disclosed code execution, broad local data access, and local service surfaces that deserve manual review.

Review this before installing as a high-privilege local tool. Use it only in a sandbox or low-privilege account, avoid exposing the MCP HTTP server to browsers or untrusted pages, do not route untrusted input to codeExecutor/selfInitiator/codeWriter, and inspect or limit stored memory before enabling prompt injection or export.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (203)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises and documents capabilities including environment variable access, file read/write, shell execution, and network use, but does not declare permissions or constrain them in a machine-readable way. This creates a transparency and least-privilege failure: hosts or reviewers may underestimate what the skill can do, increasing the chance of unsafe deployment or unexpected access to local data and services.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documented `hf_judge.js` adds a local CLI entrypoint that loads code from a hard-coded filesystem path under the user's home directory. In a skill whose stated purpose is cognitive reflection rather than system administration, this expands the attack surface by enabling local code loading and execution paths that are unnecessary to the core function and could be abused if that path is replaced, tampered with, or unexpectedly present.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The report says `hf_judge.js` implements the four-step safety judgment flow, but the sample code calls `shouldBeSilent(input)` even though the documented implementation expects a context object like `{ input, personInPain, emotionIntensity }`. This mismatch can silently disable or distort safety logic, producing incorrect judgments in crisis-related cases and creating a dangerous false sense that protections are active when they are not.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The JSON-RPC POST endpoint sets `Access-Control-Allow-Origin: *`, allowing any website opened in the user's browser to issue cross-origin requests to this local MCP service. Because the server exposes powerful introspection and memory-related tools without authentication or origin checks, a malicious page could drive the local service and read back responses, which is especially risky for a long-running localhost agent service.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The comment states that lastAccessed updates should only occur when HEARTFLOW_DEBUG is enabled, but the code always mutates hfm.learned and persists it. This mismatch creates hidden state changes during what appears to be a read/emit operation, which can affect retention, auditing, and downstream prompt injection behavior without operator awareness.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script is presented as an injector that outputs text for prompt inclusion, but it also performs persistent writes to learned memory and to memory-inject.txt. That hidden write behavior violates least surprise and can be security-relevant because prompt-generation steps often run in automated pipelines where side effects are unexpected and may alter future model behavior.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The export command writes accumulated memory content, including LEARNED and EPHEMERAL values, to a plaintext file on disk. Even though CORE values are redacted, this still creates an easy bulk-exfiltration path for potentially sensitive conversation-derived data, increasing the chance of disclosure through filesystem access, backups, sharing, or accidental upload.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The engine records full userInput plus rich per-layer processing data into lastProcessing and processingLog, creating unnecessary retention of potentially sensitive natural-language content and inferred metadata. In a cognition/reflection skill, these traces can contain intimate or psychological content, so keeping them in memory beyond immediate processing increases exposure to accidental disclosure, debugging misuse, or later exfiltration by other components.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The diagnostic APIs expose full internal traces, including user input, intermediate reasoning layers, emotional/thought vectors, and generation traces. This creates a direct data leakage surface because any caller with access to these methods can retrieve sensitive conversational content and model-internal derived data that is not required for normal user-facing operation.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The module inspects memory logs for user frustration, confusion, and interruption patterns in order to generate goals, which extends beyond simple internal self-reflection into behavioral profiling of users. Even though scanning is gated behind HEARTFLOW_DEBUG, the capability is present and can process persisted user-derived data without clear purpose limitation, consent, or minimization controls.

Intent-Code Divergence

Low

Confidence: 81% confidence
Finding: The code comment claims persistence is only enabled in debug mode as a security fix, but the constructor still unconditionally loads goal and heartflow state data from disk via loadGoals() and loadHeartflowState(). This creates a mismatch between intended and actual behavior, allowing previously persisted potentially sensitive state to continue influencing runtime even when persistence is supposedly disabled.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The code path named 'llm_query' actually enumerates and reads local log files, then returns log previews. This is a capability mismatch that can expose potentially sensitive local data under the guise of a reasoning operation, increasing the risk of unintended data disclosure to callers or downstream components.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The engine can enumerate and read log and test files across the projectRoot even though the skill is presented as a cognitive/philosophical engine, not a file-inspection tool. That broad local visibility expands the attack surface and may leak internal paths, error traces, test names, or other sensitive project metadata without a clear necessity tied to the stated purpose.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The header claims a 'safe restricted mode' sandbox, but the implementation performs direct fs reads and writes under projectRoot with no visible sandbox enforcement, policy engine, or boundary validation. Misrepresenting unrestricted filesystem access as sandboxed can lead integrators to trust the component with higher privileges than is safe, enabling unauthorized persistence and data access.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The module performs unsolicited psychological and parenting inference based on keyword matching and then generates intergenerational trauma-style narratives about the user and their child. Even with disclaimers, this can steer users into sensitive mental-health interpretations without clear consent, reliable grounding, or professional safeguards, which is risky for a general reflection skill.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The transparency report populates `parentingReflectionTriggered` with all protocol IDs unconditionally, which falsely implies the parenting reflection flow ran even when it did not. This undermines auditability and user trust, and can mislead downstream systems or operators who rely on the report to understand what sensitive processing actually occurred.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file implements a general-purpose multi-language code execution engine with JavaScript, shell, and Python subprocess support, which is far broader than the declared purpose of a cognitive/self-reflection skill. The mismatch increases supply-chain and trust risk because users or host systems may grant the skill capabilities they would not reasonably expect from its description.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The shell execution path passes attacker-controlled input to execSync with /bin/bash, enabling arbitrary command execution on the host. The blacklist only blocks a small set of known-dangerous patterns and is trivially bypassable, leaving filesystem access, network access, persistence, and lateral movement available to crafted commands.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The Python execution path writes untrusted code to a temporary file and runs it as a subprocess, granting the code the interpreter's full host privileges. This allows arbitrary file access, network activity, process spawning, data exfiltration, and resource abuse, none of which are justified by the skill's stated purpose.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The module advertises a safe or strict sandbox, but its JavaScript execution relies on new Function, which executes code in the current Node.js process rather than true isolation. This is especially dangerous because the safety claim may cause integrators to trust the feature and expose it to untrusted input despite the lack of process, capability, or memory isolation.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The sandbox method claims to allow only console.log and basic arithmetic, but in reality it executes arbitrary JavaScript unless the source matches a blocked regex. Regex-based blocking is incomplete and bypassable, so untrusted code can still reach dangerous capabilities or exhaust resources while callers believe the environment is restricted.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file materially exceeds the declared purpose of the skill. Instead of cognition/reflection logic, it implements a broad code-generation engine that can synthesize executable JavaScript and Python for networking, filesystem access, encoding, batching, and other operational tasks, creating undeclared capability expansion and increasing the attack surface. In the context of a reflective/psychology-oriented skill, this mismatch is especially risky because users and reviewers would not expect code execution-enabling behavior.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The module can generate HTTP-requesting and filesystem-writing code even though the skill is presented as a cognition/self-reflection engine. That enables users or downstream components to obtain operational code for data exfiltration, remote interaction, or local file modification under the cover of an unrelated skill description, which is a dangerous capability mismatch.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The file exposes a large catalog of code-synthesis intents spanning sorting, fetching, file I/O, encoding, plotting, pipelines, validation, and batch processing. Even where individual templates are not inherently malicious, bundling broad multi-domain synthesis into a skill whose declared purpose is reflective cognition creates hidden functionality and substantially broadens the ways the skill can be repurposed.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The comments claim the engine avoids asserting internal causality, but convertToObservableReport rewrites first-person introspective statements into authoritative-sounding observational claims such as '因为数据显示' and '我观察到…'. In a psychology/self-reflection skill, this can misrepresent uncertainty, fabricate evidentiary grounding, and launder speculative inner-state claims into more credible output that users may trust for mental-health-style interpretation.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/code-engine.js:68

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/code-verifier.js:385

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/code/code-executor.js:571

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/proactive/self-initiator.js:896

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/code-engine.js:1586

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/code-verifier.js:366

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/code/code-executor.js:481

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/proactive/self-initiator.js:484

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/core/search/hybrid-search.js:51

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/core/search/hybrid-search.js:421

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: src/utils/atomic-write.js:139