Security audit

Heartflow Skillhub V2

Security checks for vulnerabilities and agentic risk

Overview

This looks like a broad local AI helper, but it under-discloses external API use, local server behavior, and privileged runtime features.

Install only if you are comfortable with a large local agent engine that can persist memory, expose a localhost MCP HTTP service, and optionally execute code or call external APIs. Do not provide HEARTFLOW_API_KEY, HEARTFLOW_MCP_TOKEN, HEARTFLOW_CODE_EXECUTOR_ENABLED, HEARTFLOW_ENABLE_SELF_MODIFICATION, or local API-key files unless you intend those capabilities, and run it in an isolated environment for testing.

SkillSpector

SkillSpector could not complete.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/code/code-executor.js:758

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/code-verifier.js:398

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/code/code-executor.js:1238

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/code-verifier.js:379

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/reasoning/executable-reasoning.js:101

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/emotion/empathy-responder-optimized.js:14