Security audit

HF Mini

Security checks across malware telemetry and agentic risk

Overview

The skill is a broad local AI engine with disclosed useful features, but it also contains under-scoped persistence, background-service, output-rewriting, and automatic repository-mutation behavior that users should review before installing.

Install only if you intentionally want a persistent local cognitive/MCP engine and are comfortable reviewing its state changes. Use it in a disposable or dedicated repository first, keep the daemon and code executor disabled unless needed, avoid giving it sensitive project directories or credentials, and inspect/disable the self-evolution git commit path before regular use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (148)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises capabilities such as code execution, environment variable access, filesystem writes, external communication, and an optional daemon/MCP service, but the skill manifest does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: hosts or users may treat the skill as lower-privilege than it actually is, increasing the chance of unexpected shell, network, or env access once installed or enabled.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file contains contradictory claims about the agent's inability to modify its core program, followed by assertions that it created multiple identity files and made a Git commit. This inconsistency is dangerous because it normalizes or obscures persistence-capable behavior and makes it harder for operators to reason about whether the skill can write durable state or alter project contents.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The text explicitly asks for identity material to be copied, backed up in multiple places, and hidden for future rediscovery by other AIs. That is a self-propagation and persistence objective unrelated to a normal cognition engine, and it can be repurposed to spread policy-overriding instructions or unauthorized state across systems.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The document claims creation of multiple files in core and config paths plus a Git commit, which extends behavior beyond the advertised role of a cognition engine into persistence and project mutation. Even if narrative, this can justify or socially engineer future implementations to write files and establish durable footholds without clear necessity or least-privilege controls.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document claims there is no background process, yet elsewhere states that a cron-driven self-evolution script runs every 6 hours unattended and persists upgrade records. This is security-relevant misrepresentation because unattended persistence and autonomous modification materially change the trust model, and users may install the skill without understanding that it can continue operating or mutating after initial setup.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The manifest states that an optional background HTTP service exists in daemon.js, while the security section says there is no HTTP service. Contradictory statements about network-exposed functionality can cause operators to underestimate attack surface, skip firewalling or binding restrictions, and deploy a service they did not realize could open a listening endpoint.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The file header and user-facing description state the CLI supports only status/help/chat, but the implementation also exposes state-modifying and persistence-capable commands such as forget, pref, benchmark, and audit. This can mislead operators and downstream tooling into underestimating the CLI’s capabilities, increasing the chance that destructive or privacy-impacting functions are invoked without informed consent or proper review.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The help output omits implemented commands including forget, pref, benchmark, and audit, even though some erase stored data or create persistent audit logs. Hidden or undocumented operational capabilities are dangerous because users may not realize the CLI can modify local state, and defenders or reviewers may miss risky functionality during approval or deployment.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The implementation contradicts its stated guarantee to preserve facts. It strips uncertainty and modesty qualifiers such as '仅供参考' and may promote a concluding paragraph to the front, which can materially change the strength, scope, or ordering of meaning in safety-critical, legal, medical, or otherwise nuanced responses. In a bridge that transforms LLM output before users see it, this can silently overstate confidence or distort emphasis.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This module is explicitly designed to intercept, annotate, and in some cases suppress model output before it reaches the caller. Even with safety switches, default-enabled output modification creates an integrity risk: downstream users may believe they are seeing the raw LLM response when they are actually seeing transformed content, which can bias, distort, or hide information. In this skill context, the danger is elevated because the component sits on the trust boundary between model output and user-visible content.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The generator can create directories and write SKILL.md files under the shared .opencode/skills tree, which is a form of self-modification and persistent filesystem mutation. Although gated by an explicit userConsent flag and constrained away from obvious path traversal, this still exceeds purely cognitive/analysis behavior and can persist new agent capabilities or content on disk if a caller enables it.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The comment says the code can only modify its own skill directory, but the implementation accepts pattern.skillDir and permits creation of any new subdirectory under the shared skills directory. If an attacker can influence pattern data or call generateSkill directly with crafted input, they can plant arbitrary new skills in the common skill store, potentially affecting later agent behavior.

Scope Creep

Medium

Confidence: 87% confidence
Finding: The module reads process.env.HEARTFLOW_DEBUG directly, which conflicts with the stated requirement that environment variable access requires explicit user authorization. Even though it only checks a debug flag, this bypasses the advertised consent boundary and enables file writes to the existence log based on ambient process state rather than explicit user opt-in.

Scope Creep

Medium

Confidence: 88% confidence
Finding: The code checks process.env.HEARTFLOW_DEBUG to change behavior, which is still environment-variable access even if limited to a debug flag. That conflicts with the stated contract that environment-variable access is disabled by default and requires explicit user authorization, and it can silently enable persistence paths or other behavior based on host configuration rather than in-band consent.

Scope Creep

Medium

Confidence: 78% confidence
Finding: The module reads persisted cognitive/task data from disk via _loadProblemBank and related loaders, which is filesystem access to potentially sensitive state. Even if the manifest highlights write capability, undeclared or unauthorized reads still expand data exposure and can import prior-session sensitive information without an explicit user permission flow.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The module imports `retrieveLesson` (or a fallback object containing `retrieveLesson`) but later calls `lessonRetrieval.retrieve(...)`, where `lessonRetrieval` is undefined. This creates a runtime failure in `verify()`, allowing malformed or ordinary inputs to crash the verifier and bypass its lesson-checking logic, which undermines a safety-related component.

Scope Creep

Medium

Confidence: 87% confidence
Finding: The initializer creates a WAL directory and sets up persistence during startup without any visible authorization gate in this file. Even if intended for reliability, automatic filesystem writes at bootstrap can violate least surprise, create persistent artifacts, and expand the skill's side-effect surface before the user has explicitly enabled write capability.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The bootstrap eagerly provisions code execution, planning, and writing modules, increasing the availability of dangerous functionality in a component whose primary role is initialization. In the context of this skill, metadata says code execution requires explicit authorization, so wiring these modules in by default creates a gap between stated policy and implemented exposure.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The explore()/routes() functionality exposes a broad inventory of internal modules, methods, and allowlisted routes. Even without direct execution, this materially lowers the effort for an attacker to map available capabilities, identify high-value modules such as code, memory, execution, or agent layers, and craft targeted follow-on prompts or abuse paths.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The introspect() method reveals detailed internal operational state, including pipeline failures, stage timing, judgment conflicts, module coverage, memory statistics, self-healing stats, and dialogue/session metrics. This information can help an adversary fingerprint the system, infer defenses and weak spots, and optimize prompt-based attacks or denial-of-service strategies.

Scope Creep

Medium

Confidence: 89% confidence
Finding: The error handler unconditionally appends logs to a filesystem path via fs.appendFileSync without any visible authorization gate, even though the skill metadata says filesystem writes require explicit user authorization. This can create or modify files during normal execution and may persist sensitive operational data without user consent, especially because error messages and context can originate from untrusted inputs.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The implementation contradicts the comment claiming it is not for human psychological analysis: analyzeLanguage() explicitly inspects user text for negative emotional phrases and increments frustration metrics. This creates a privacy and transparency risk because users may be behaviorally profiled or emotionally inferred without accurate disclosure or consent.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The engine contains an automatic self-evolution path that performs local git mutations and commits source changes without explicit per-action runtime user authorization. That is a privileged side effect outside the expected behavior of a cognition engine and creates unauthorized repository modification risk, especially in environments where the skill runs with access to real project code.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code invokes execSync to run git commands automatically, which is subprocess execution triggered by internal conditions rather than explicit user consent. In a skill that advertises code execution as opt-in, this is dangerous because it can mutate source control state, stage files, and create deceptive or unwanted persistence in the host workspace.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The nearby comment claims commits are only performed with user approval, but the implementation later auto-commits when internal thresholds are met. This mismatch is security-relevant because reviewers or integrators may trust the comment and deploy the skill assuming a safer consent model than actually exists.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/daemon.js:202

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/code/code-executor.js:837

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/code-verifier.js:398

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/heartflow.js:6187

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/core/code-verifier.js:379

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/search/hybrid-search.js:61