Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/daemon.js:202
Security audit
心虫 HeartFlow 认知引擎
Security checks across malware telemetry and agentic risk
Overview
HeartFlow is a broad local cognitive engine, but its package under-discloses and inconsistently describes persistent memory, background service, and code-execution capabilities.
VirusTotal
VirusTotal findings are pending for this skill version.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/code/code-executor.js:837
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/core/code-verifier.js:398
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- src/core/code-verifier.js:379
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/search/hybrid-search.js:61