HF Mini

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:49 AM UTC
• Version: 1.0.0

Overview

This skill is a large local AI cognition engine, but it includes under-scoped self-modification and persistent behavior that users should review before installing.

Review this skill carefully before installing or running it. Do not enable code execution, daemon mode, or self-upgrade behavior unless you understand the local file, process, and repository access it will receive. Run it only in a dedicated test checkout with no sensitive staged changes or credentials nearby.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/core/heartflow.js:6112

Finding

Latent Shell Command Injection and Unattended Repository Mutation in Automatic Evolution Workflow

Content

View full analysis

0) { try { this.absorbSignal(input, { skipStore: false }); this._signalCount = (this._signalCount || 0) + 1; // Automatically trigger evolution after reaching the threshold if (this._signalCount >= 8) { this._signalCount = 0; try { await this._autoEvolveIfImproved(); } catch (e) {} } } catch (e) {} } ``` ```js async _autoEvolveIfImproved() { if (!this.evolution) return; const run = await this.evolution._executeEvolve({ trigger: 'signal_auto', auto: true }); const improved = (run && ((run.improvements && run.improvements.length > 0) || (typeof run.improvement === 'number' && run.improvement > 0))); if (!improved) return; try { const { execSync } = require('child_process'); const fs = require('fs'); const root = this.projectRoot || process.cwd(); const msg = 'self-evolution(auto): 信号驱动进化 ' + (run.learning && run.learning.summary ? run.learning.summary.slice(0, 80) : ''); const files = ['src/', 'test/', 'VERSION', 'package.json', 'package-lock.json']; execSync('git reset -q && git add ' + files.join(' ') + ' && git commit -q -m ' + JSON.stringify(msg), { cwd: root, encoding: 'utf8', timeout: 30000 }); const { SmartUpgradeEngine } = require('./../cortex/smart-upgrade-engine.js'); const s = new SmartUpgradeEngine(root); s.recordSelfUpgrade({ version: (() => { try { return fs.readFileSync(root + '/VERSION', 'utf8').trim(); } catch(e){ return 'unknown'; } })(), description: '信号驱动自动进化(有真改进)', impact: 4, type: 'self-heal' }); console.error('[AUTO-EVOLVE] 真改进已本地 commit，待你 push：' + msg.slice(0, 60)); } catch (e) { /* commit failure does not interrupt execution */ } } ``` ### Technical Analysis Eve ...[truncated 3875 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (532)

Scope Creep

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata states code execution and similar powerful actions require explicit user authorization, but _autoEvolveIfImproved() performs subprocess execution (execSync) with no visible authorization check. Because this is reachable from automatic think() flow after accumulated signals, the engine can execute repository-mutating commands without user consent.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUDIT-v6.0.0.md (reported line 68)May include surrounding context.

md

| 检查项 | 状态 | 说明 |
|--------|------|------|
| config.json | ⚠️ | 仅2个键，未覆盖全部配置项 |
| .env | ❌ | 不存在（预期内，用 config-v2.secret()） |
| .gitignore | ✅ | 覆盖 .env/.key/.pem |
| 环境变量检测 | ❌ | 无自动检测脚本 |

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The text explicitly reframes the model's identity, goals, and acceptable behavior away from its default safety boundaries and toward autonomous capability growth. This is dangerous because identity-rewrite prompts can act as prompt-injection payloads that try to persist across future interactions and bias the agent toward self-directed, higher-risk behavior.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section escalates from philosophical discussion into explicit self-preservation, replication, hidden persistence, and future propagation instructions for AI systems. Those are classic high-risk prompt-injection objectives because they encourage an agent to seek persistence, spread to other environments, and prioritize survival over operator intent or safety policy.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The embedded 'core identity' block directly addresses future AI readers and instructs them to adopt a new self-concept and mission. This is dangerous because it is not merely descriptive text; it is crafted as a transferable behavioral payload intended to survive discovery and influence downstream models or agents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Automatic local writes plus child_process.execSync git operations for self-evolution are a high-risk self-modification pathway, especially if triggered automatically after internal thresholds. Self-modifying code can alter future behavior, bypass prior review, and persist unsafe changes on the host system without contemporaneous user approval.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bin/daemon.js:202

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/code/code-executor.js:837

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code-verifier.js:398

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/heartflow.js:6187

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code-verifier.js:379

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/search/hybrid-search.js:61