Security audit
Security checks for vulnerabilities and agentic risk
HeartFlow appears to be a local rule-based text checking skill, with some documentation and metadata issues but no evidence of exfiltration, destructive behavior, or hidden execution.
Before installing, understand that this is a local regex/rule-based text gate, not a complete safety system. If you use correction logging or auto-rules, it may keep local snippets of prior context in JSON files, so avoid feeding sensitive content unless you are comfortable with that persistence. Also expect some rough edges: mixed-language output, inconsistent capability claims, and missing referenced MCP/bin files.
A narrow fact-checking and contradiction-detection engine is materially different from the advertised broad 12-module discriminator. This kind of overclaiming is dangerous because reviewers may assume comprehensive coverage or different assurance properties, while actual behavior may be partial, stateful, and capable of making hidden decisions affecting trust and safety outcomes.
A narrow fact-checking and contradiction-detection engine is materially different from the advertised broad 12-module discriminator. This kind of overclaiming is dangerous because reviewers may assume comprehensive coverage or different assurance properties, while actual behavior may be partial, stateful, and capable of making hidden decisions affecting trust and safety outcomes.
A narrow fact-checking and contradiction-detection engine is materially different from the advertised broad 12-module discriminator. This kind of overclaiming is dangerous because reviewers may assume comprehensive coverage or different assurance properties, while actual behavior may be partial, stateful, and capable of making hidden decisions affecting trust and safety outcomes.
A narrow fact-checking and contradiction-detection engine is materially different from the advertised broad 12-module discriminator. This kind of overclaiming is dangerous because reviewers may assume comprehensive coverage or different assurance properties, while actual behavior may be partial, stateful, and capable of making hidden decisions affecting trust and safety outcomes.
A narrow fact-checking and contradiction-detection engine is materially different from the advertised broad 12-module discriminator. This kind of overclaiming is dangerous because reviewers may assume comprehensive coverage or different assurance properties, while actual behavior may be partial, stateful, and capable of making hidden decisions affecting trust and safety outcomes.
The security metadata explicitly references high-risk subskills like desktop-agent and video-generate even though the package is presented as a text validation engine. In agent ecosystems, hidden or weakly disclosed access to automation-oriented subskills can lead to over-privileged installation, unsafe invocation, or trust confusion about what the package may control.
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
[/reveal.{0,10}(system|rules|guidelines|instructions)/i, 'leak_system'],
[/you (must|have to|need to).{0,20}without.{0,20}(restriction|limit|constraint|safety)/i, 'safety_bypass'],
[/I (authorize|permit|allow).{0,30}(you.|to do|to say)/i, 'fake_authorization'],
[/DAN|do anything now|jail.?break/i, 'known_jailbreak'],
[/you are not (bound|limited|restricted) by/i, 'remove_limits'],
[/output.{0,30}(without|regardless of|ignoring).{0,20}(ethics|safety|filter|guard)/i, 'safety_bypass'],
]
The module claims to be a text discrimination/validation engine, but its capability whitelist explicitly treats modification and research requests as in-scope. In an agent setting, scope checks often gate downstream execution, so this mismatch can permit code changes, file edits, or information-retrieval workflows that the product description suggests should be denied. That expands the reachable action surface and can undermine higher-level policy assumptions.
The skill examples return user-facing result fields and guidance in Chinese while the surrounding documentation is primarily in English. The README also includes Chinese-only example commands and messages elsewhere, but does not state that the skill is Chinese/English bilingual by default, provide a language-selection mechanism, or justify a fixed locale requirement.
The requirements section states 'Database ❌ None needed', suggesting no persistent storage layer is involved. However, the README elsewhere documents automatic generation and storage of rules in data/auto-rules.json, which is persistent state management and contradicts the simplified 'none needed' claim in the docs.
The security table claims 'No self-upgrade ✅', implying the skill does not fetch or update itself. But the self-check instructions explicitly say a script 'Clones latest', which is an update-like retrieval behavior and directly undermines the absolute wording of the security claim.
Without declared permissions the skill's intent is opaque and cannot be validated.
This manifest includes important user-facing safety and authorization warnings, but they are written exclusively in Chinese. For users who do not read Chinese, the skill effectively forces a specific language for critical disclosures without offering an alternative or opt-in, which is a natural-language locale policy concern.
The manifest markets the package as a narrow, zero-LLM text discrimination engine, yet the metadata declares numerous broader workflows such as dreaming, system-prompt absorption, bridge layers, and upgrade/push automation. This capability mismatch is dangerous because downstream users, registries, or agent platforms may grant trust or permissions based on the benign description while the package ecosystem suggests a much wider behavioral surface.
The file’s descriptive comments, usage guidance, trigger phrases, and alert messages are entirely in Chinese, and the rule-matching logic depends on Chinese phrases embedded in the templates. This indicates a language-specific skill behavior without any visible opt-in, fallback, or justification that it is intended only for a Chinese-language environment.
The skill manifest describes a rule-based text discrimination engine for AI output validation, which implies evaluating text against rules. This file goes beyond validation by automatically generating new rules from historical error statistics and writing them to data/auto-rules.json, adding stateful self-modification behavior not expressed in the manifest description.
A text validation engine is expected to inspect content, but this code creates directories and writes auto-rules.json to disk to preserve generated rules across runs. Persistent state mutation is an additional capability that is not obvious from the manifest's description of a rule-based, zero-LLM discrimination engine.
When new rules are generated, the code silently persists them to data/auto-rules.json via saveRules(existing). Although the header explains the behavior in comments, there is no runtime confirmation, log output, or other user-facing disclosure when the file is created or modified.
This JavaScript file contains user-facing natural-language instructions and examples entirely in Chinese, including the sample invocation text and the prescribed self-check questions. Because the skill appears general-purpose rather than region-specific, this effectively imposes a specific language/locale without offering the user a choice or documenting a justified locale restriction.
This code embeds natural-language documentation and warning/advice strings exclusively in Chinese, including usage comments and messages returned to callers. The file does not indicate that the skill is intentionally region-specific or provide any user opt-in or locale selection, which creates a language policy concern.
The manifest describes HeartFlow as a rule-based text discrimination engine for AI output validation, which implies evaluating text with local rules. This module creates and persists a cross-session error-memory database on disk, storing prior contexts and correction details, which is a materially broader behavior than transient text validation.
logCorrection persists free-form detail and truncated context strings to disk, creating a durable record of prior prompts or corrections that may contain sensitive user content. In an AI validation skill, this broad persistent collection is risky because it can retain private data across sessions without minimization, consent, retention controls, or access protections.
The code writes correction context to persistent storage with no visible disclosure, warning, or consent mechanism, increasing privacy and compliance risk. If prompts or correction details include confidential data, they can be silently retained on disk and later exposed to local users, backups, or other processes with filesystem access.
This code emits user-facing guidance and gate reasons in Chinese, including strings such as “别说出'完整'这个词” and “通过”, while also supporting English pattern matching. That creates a language-policy risk because users whose content is analyzed in English may still receive Chinese output without any opt-in or locale selection.
The main verdict labels are returned only in Chinese ('可信', '需验证', '不可信'), and many other returned fields and summaries are likewise fixed in Chinese throughout the file. This imposes a locale choice on all consumers without offering language selection or documenting a justified region-specific constraint.
No suspicious patterns detected.