Mark Heartflow Skill

• Outcome: Review
• Latest audit: Jun 10, 2026 · 4:25 PM UTC
• Version: 2.9.1

Overview

The skill is not clearly malicious, but it combines persistent memory, automatic prompt injection, a local daemon, and broad code execution in ways users should review carefully before installing.

Install only if you want a persistent local memory layer that can modify future prompts and if you are comfortable with local code execution features. Review and restrict who can call the dispatch routes, avoid enabling the Hermes memory-injection plugin for sensitive conversations, set SHUTDOWN_TOKEN before running the daemon, and periodically inspect or delete the memory/ and data/ directories.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (246)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return _last_inject

    try:
        result = subprocess.run(
            ["node", MEMORY_INJECT_SCRIPT],
            capture_output=True,
            text=True,

• Confidence: 90% confidence
• Finding: result = subprocess.run( ["node", MEMORY_INJECT_SCRIPT], capture_output=True, text=True, timeout=10, cwd=HEARTFLOW_SKILL_DIR,

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares no permissions while its own documentation advertises capabilities that access environment variables, read and write local files, invoke child processes, and perform network requests. This is dangerous because operators and downstream policy systems may trust the manifest and enable the skill under a lower-risk assumption than its real behavior warrants.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented identity of the skill is philosophical and cognitive, but the same file discloses operational behaviors such as persistent memory harvesting, prompt injection into future conversations, daemon/socket exposure, shutdown control, and child-process execution. This mismatch is risky because users and reviewers may consent to a reflective assistant while unknowingly deploying infrastructure that persists data and alters future prompts, increasing the chance of stealthy data leakage or prompt poisoning.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The report documents self-modification and self-evolution features in a skill presented primarily as a cognitive/philosophical reasoning engine. That capability mismatch increases risk because users may grant trust appropriate for a reasoning assistant while the codebase also contains mechanisms that can alter behavior or code over time, expanding attack surface and making review harder.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The report indicates external API/network behavior despite the skill being framed around internal thought, memory, and philosophy. This mismatch can lead to unexpected data egress and privacy risk because operators may not anticipate network transmission from a supposedly local cognitive engine.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Documented self-modification is not justified by the stated purpose of the skill and creates a materially different trust boundary. Even if consent checks were added, a system that can rewrite itself is more difficult to audit, can bypass prior safety assumptions, and may become a persistence or supply-chain risk if abused.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: A skill-generation capability is powerful and not obviously necessary for a philosophical reasoning engine. Such a feature can create or alter executable artifacts, which broadens the blast radius from simple reasoning errors to code generation, policy circumvention, or unauthorized capability expansion.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The report notes external embedding/data transmission capability that does not align with the stated local reasoning purpose. Even with opt-in mitigation, undocumented or weakly governed transmission can expose sensitive user content and create compliance concerns.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The `bundle` command performs more than its advertised analysis role: it invokes `getMemoryInject()`, which executes an external script and returns its output to the caller. This creates an unexpected side effect and expands the trust boundary, because a seemingly informational CLI path can run additional code and expose whatever that helper script emits.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: `getMemoryInject()` uses `execFileSync('node', [injectPath], ...)` to launch a secondary script from the skill directory. Even though the path is not shell-interpolated, this still grants code-execution capability to a helper file whose behavior is outside the visible CLI flow, enabling hidden actions, data access, or persistence if that file is modified or malicious.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The client exposes a direct `shutdown()` operation over the daemon socket without any visible authorization, caller restriction, or clear need tied to the stated cognitive-engine purpose. If untrusted plugins or other local code can import this client, they may be able to stop the daemon on demand, causing a denial of service and disrupting all dependent functionality.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The code claims shutdown requires a token, but actually allows shutdown whenever SHUTDOWN_TOKEN is unset because it only rejects invalid tokens if an expected token exists. Since the daemon listens on a predictable Unix socket in /tmp, any local process able to connect can terminate the service, causing denial of service.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: Spawning an external Node.js script is an unnecessary privileged capability for a plugin whose stated purpose is memory injection. This mismatch matters because the script can perform arbitrary filesystem or process actions and its output is trusted for system-prompt augmentation, increasing the chance of hidden behavior or indirect prompt compromise.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The plugin is designed to inject accumulated identity, lessons, preferences, emotions, and dialogue records into every new system prompt. That creates persistent cross-session data propagation and may expose prior user content or sensitive state to future model executions without contextual minimization or consent.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The script is presented as a prompt injector but also silently persists the rendered memory payload to disk, creating an additional disclosure surface for sensitive prompt content. In a skill whose purpose is to aggregate memories, conversations, preferences, and emotional signals, undocumented persistence materially increases the chance of unintended retention, reuse, or exfiltration.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The export command writes all stored memory, including CORE identity-related data, into a plaintext file on disk. In this skill context, persistent memory may contain sensitive conversation-derived data, so creating a bulk plaintext dump materially increases the risk of disclosure through local compromise, accidental sharing, backups, or other tools reading the file.

Context-Inappropriate Capability

Medium

• Confidence: 75% confidence
• Finding: The module introduces persistent behavior tracking, analytics, and categorization capabilities that are not justified by the stated 'cognitive engine' description. In an agent-skill context, hidden or poorly disclosed behavioral telemetry can create privacy risk, especially because it stores longitudinal user activity and derived metrics without any visible consent, minimization, or retention controls.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The engine stores rich per-request traces including raw userInput, layer outputs, coherence data, and generated responses in memory, then exposes them through getFullTrace(), getLastProcessing(), and getProcessingLog(). In a conversational/cognitive engine context, this creates an unnecessary disclosure surface for sensitive user content and internal inference data, especially if these APIs are reachable by other components or users.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: `associateWord()` is presented as a query path but it mutates long-term model state by calling `recordUse()` and `strengthenAssociation()`, and that state is later persisted. This creates hidden side effects from read-like operations, enabling untrusted inputs to poison memory over time and making behavior non-deterministic across runs.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The retriever exposes addPrototype/removePrototype behavior and persists changes to disk, which extends the component from passive matching into state-modifying behavior. In an agent skill context, silent persistent mutation of local knowledge can be abused by upstream prompts or untrusted callers to poison future behavior, alter outputs over time, or erase expected prototypes without explicit authorization boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The code performs local filesystem reads at initialization and later writes via the same prototype path, giving the skill persistent local state access beyond pure in-memory narrative matching. In a skill ecosystem, unnecessary filesystem access increases attack surface: compromised or prompt-influenced flows can read corrupted local data, persist manipulated state, and create non-transparent cross-session behavior.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: In debug mode, the component persists recent trace data, including thoughtVector-derived data and the final generated response, to disk under the project directory. Even if gated by an environment variable, this creates unnecessary local data retention for potentially sensitive conversational or behavioral data, which can be exposed to other local users, backups, logs, or support bundles.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The module scans local memory JSON logs and performs behavioral inference about user interruption, frustration, and confusion. Even though scanning is gated by HEARTFLOW_DEBUG, this still introduces a surveillance-style analysis path over stored user data that exceeds the stated philosophical/goal-generation purpose and can expose sensitive interaction patterns if debug mode is enabled in production or by mistake.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The comments claim persistence was restricted to debug mode, but the constructor still unconditionally loads generated goals from disk during normal operation. This mismatch is dangerous because users and reviewers may believe persistent state is disabled when in fact historical state is still consumed, creating privacy, consent, and trust issues and enabling unintended cross-session data use.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The 'llm_query' path is misleading because it silently reads local log files and returns previews of their contents. That creates an information disclosure risk: callers may invoke what appears to be an abstract reasoning step, but instead receive potentially sensitive local data from project logs without clear consent or least-privilege boundaries.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code-engine.js:68

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code-verifier.js:385

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code/code-executor.js:283

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/proactive/self-initiator.js:896

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code-engine.js:1586

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code-verifier.js:366

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code/code-executor.js:472

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/proactive/self-initiator.js:484

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/core/search/hybrid-search.js:51

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/core/search/hybrid-search.js:421

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: src/utils/atomic-write.js:139