Mark Heartflow Skill

• Outcome: Review
• Latest audit: Jun 12, 2026 · 8:58 AM UTC
• Version: 2.10.1

Overview

This appears to be a real cognitive memory engine, but it also includes broad code execution, local service, and persistent memory capabilities that exceed the main self-reflection description.

Install only if you want a broad local agent memory/middleware package, not just a passive reflection prompt. Review and disable the daemon/MCP/plugin paths unless needed, set SHUTDOWN_TOKEN if using the daemon, keep external embeddings opt-in off unless you trust the provider, and run it in a sandboxed workspace if you do not want shell/Python/JavaScript execution or durable memory files touching your main environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (234)

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The changelog documents active code generation and execution-related capabilities that materially exceed the skill's declared cognitive/self-reflection purpose. That mismatch is dangerous because downstream users, reviewers, or orchestration systems may grant this skill broader trust or permissions than intended, enabling unexpected code or script execution paths.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: Describing the skill as a 'mini-agent engine' with execution and planning modes directly conflicts with the stated limited cognitive-engine role. This creates a security boundary failure: operators may treat it as low-risk reflective tooling while it actually supports action-oriented agent behavior, increasing the chance of unsafe invocation with sensitive tools or environments.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Multi-language code and shell execution is context-inappropriate for a self-reflection/dream-synthesis skill and substantially expands the attack surface. Even if labeled as sandboxed, such capability can be abused for command execution, unsafe file access, dependency abuse, or privilege escalation attempts if the sandbox or calling environment is imperfect.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Mini-agent and task-execution features are unjustified by the stated purpose and can enable autonomous or semi-autonomous actions outside user expectations. In a skill presented as introspective/cognitive, this mismatch makes the capability more dangerous because users may not anticipate operational side effects such as code runs, tool use, or task automation.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documented `hf_judge.js` script loads executable code from a hard-coded path under the user's home directory (`~/.hermes/skills/...`). That creates an implicit trust boundary on filesystem contents: if that path is replaced, tampered with, or symlinked, the script will execute attacker-controlled local code. In the context of a 'cognitive/reflection' skill, this extra filesystem code-loading capability is not clearly necessary and increases attack surface.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The CLI executes an additional local script via execFileSync and returns its output as part of normal processing, expanding the trust boundary beyond the documented analysis engine. If that script is modified, replaced, or behaves unexpectedly, callers of the CLI will unknowingly execute extra code and consume unvetted output, which is especially risky in agent/plugin environments where this CLI may be treated as a narrow analysis surface.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The bundle command includes an external "inject" payload in addition to the documented status/analysis outputs, creating a hidden side channel that can influence downstream consumers. In an agent skill context, returning injection-oriented content alongside trusted JSON analysis increases the chance that another component will ingest or apply it as instructions or memory without clear user consent or separation.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The client exposes a programmatic shutdown command for the daemon with no indication of authorization, access control, or contextual restriction. In a reusable skill library, this creates an unnecessary administrative capability that could be invoked by other components or prompt-driven tooling to disrupt service availability.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The daemon executes an external JavaScript file via a child Node.js process on every bundle request, which expands the attack surface beyond in-process analysis. If an attacker can modify that script or influence the runtime environment, they can gain arbitrary code execution in the daemon's security context; this is more concerning because the feature is exposed through a local socket service and is not essential to simple request parsing.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The code only validates the shutdown token if SHUTDOWN_TOKEN is set; when it is unset, any local client able to connect to the Unix socket can issue a shutdown command. This contradicts the stated security guarantee and enables trivial denial of service against the daemon, especially in environments where multiple local processes share the same user or can access the socket.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The status tool returns process and runtime introspection such as PID, uptime, memory usage, module counts, and internal memory-layer/Q-table state. Even though the server binds to 127.0.0.1, this still expands the attack surface by leaking operational details that can aid local adversaries, browser-based localhost probing, or any process/user on the same host with access to the endpoint.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The file exposes administrative-style observability through a health/status capability that is not necessary for the advertised cognitive-engine purpose. By itself this is low severity, but it creates an unnecessary interface that reveals service presence and liveness and can be chained with other weaknesses such as permissive CORS or localhost access from untrusted contexts.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The status tool exposes operational details such as module count, PID, uptime, memory usage, memory-layer statistics, and Q-table health that go beyond the skill’s advertised cognitive/reflection purpose. In a shared agent environment, this increases system observability for callers and can aid reconnaissance, environment fingerprinting, or debugging of adjacent components without clear need-to-know.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code returns direct process/runtime introspection data via process.pid, process.uptime(), and process.memoryUsage(), which are unrelated to the stated heartflow reasoning features. Even if not immediately exploitable on their own, these fields provide useful environmental intelligence that can be combined with other weaknesses for targeting, resource probing, or sandbox evasion.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: associateWord() is nominally a query API, but it updates in-memory long-term state by calling recordUse(), appending to recentAssociations, and strengthening top associations. In an agent skill framed around reflection, memory, and emergent growth, hidden state mutation during read-like operations can create unreviewed learning behavior and persistent drift, especially if callers expect a descriptive, side-effect-free lookup.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: associateSequence() and compoundQuery() invoke associateWord(), so bulk query operations implicitly trigger learning side effects as well. That means simple analysis/search requests can amplify and reshape the persistent association graph at scale, making the system vulnerable to prompt-driven memory poisoning or accidental long-term behavioral change.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: saveGraph() performs direct synchronous writes to a project-root JSON file without access control, path hardening beyond constructor input, transactional safety, or validation of when persistence is appropriate. In an agent environment with mutable memory semantics, this enables durable alteration of project data and increases the blast radius of misuse, corruption, or induced learning.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The component writes to a local file path derived from projectRoot and exposes add/remove operations that persist immediately via writeFileSync. In an agent/skill context, filesystem write capability inside a cognition-oriented retriever increases risk of unauthorized state modification, tampering, or persistence abuse if untrusted inputs or tools can reach these methods.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: In debug mode, the component writes interaction-derived execution metadata to disk under the project directory. Even though the persisted payload is reduced, this still creates an unnecessary persistence channel in a cognition/generation component and can expose timing, sequencing, and usage artifacts that may be sensitive in some deployments.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The safety comment understates actual data handling: the system records detailed trace objects in memory, including thoughtVector details and generated words, and exposes them through getLastTrace/getFormattedTrace. Although saveTrace currently writes only trimmed metadata, the misleading claim increases the risk of future unsafe reuse, accidental logging, or incorrect operator assumptions about what data exists and can be exposed.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: This module persistently stores internal state and event logs to disk under the project root, which expands its capability from transient cognition modeling into durable data retention. In an agent context, persistent logging can capture behavioral signals, task history, or sensitive runtime context without clear minimization, consent, retention controls, or manifest alignment, increasing privacy and integrity risk.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This code persistently reads and writes project-local state and log files as part of an autonomous control loop, which exceeds the declared 'self-reflection/personality' purpose and creates covert data collection and state retention behavior. Even though writes are limited to the project tree and some trace data is redacted, the engine still inspects logs, stores failure history, and can accumulate sensitive operational context without clear user consent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The engine performs autonomous planning and execution for code-adjacent tasks such as research, design, implementation routing, log inspection, test discovery, and failure-driven retries, which materially broadens capability beyond a reflective cognitive skill. In context, that mismatch is dangerous because it enables an agent framed as introspective to act as an autonomous project operator, increasing the chance of unanticipated data access, unsafe automation, and policy bypass through capability creep.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The planner reads and writes persistent memory files under .opencode/memory, including strategic state, tactical plans, and interaction state, even though the skill is described primarily as a cognitive/self-reflection engine rather than a data-retention feature. This creates a real privacy and integrity risk because user-derived state is silently stored on disk, can outlive the session, and may be consumed by other components without clear consent, minimization, or retention controls.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The reactive layer collects behavioral and inferred sensitivity signals such as interaction frequency, topic switching, idle time, short-input uncertainty, and negative emotion, then stores parts of that state for ongoing use. This is dangerous because it performs covert profiling beyond what is necessary for ordinary planning, increasing privacy risk and enabling downstream misuse of emotional or behavioral inferences without transparency or user control.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code-engine.js:68

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code-verifier.js:385

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code/code-executor.js:283

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/proactive/self-initiator.js:896

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code-engine.js:1586

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code-verifier.js:366

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code/code-executor.js:472

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/proactive/self-initiator.js:484

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/core/search/hybrid-search.js:51

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/core/search/hybrid-search.js:421

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: src/utils/atomic-write.js:139