Security audit

heartflow-pipeline

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a local rule-based text gate, but its documentation and metadata overstate or contradict its actual capabilities and under-disclose persistent memory behavior.

Review before installing. Treat this as a heuristic local text filter, not a verified fact checker or hardened MCP service. Avoid running any daemon/HTTP mode unless you first confirm the server code, bind it to localhost, restrict access, and understand what data is stored under data/. Clear or disable error memory for shared, sensitive, or multi-user environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The README makes a security-relevant assurance ('no background processes') while elsewhere explicitly documenting long-running daemon execution. That contradiction can mislead users and reviewers about persistence and operational exposure, causing them to deploy a continuously running service without understanding the risk.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: Declaring the product is 'not a daemon' while later instructing users to run it as a permanent daemon is materially misleading. In a security-sensitive agent skill, inaccurate statements about execution model reduce operator awareness of persistence, attack surface, and resource/lifecycle management.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The README presents a capability set far beyond the declared purpose of a zero-LLM, rule-based text gatekeeper, including memory, planning, learning, code execution, and broad MCP tooling. This kind of scope mismatch is dangerous because operators may grant the package trust, permissions, and deployment exposure appropriate for a narrow filter while actually installing a much more powerful agent platform.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill metadata says 'zero LLM dependency, pure rule engine,' but the README explicitly describes HeartFlow as a preprocessing layer feeding an LLM and lists LLM bridge modules. Misrepresenting LLM coupling and architecture can cause incorrect risk assessment, procurement approval, and sandboxing decisions by users who believe they are adopting a deterministic local-only rules engine.

Context-Inappropriate Capability

High

Confidence: 92% confidence
Finding: Advertising code execution and skill generation in a package framed as a text discrimination gate materially increases the attack surface and privilege expectations. In an agent-skill context, code execution features can be invoked indirectly through MCP or orchestration layers, turning a supposedly passive safety filter into an active execution-capable component.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: Persistent memory, encrypted memory banks, cross-session indexing, and self-healing RL are not inherently malicious, but they exceed what users would reasonably expect from a rule-based discriminator. In a security-sensitive agent deployment, hidden or underexplained persistence can lead to unintended retention of prompts, sensitive data, and behavior drift across sessions.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The README claims there are no background processes, yet it instructs users to run the MCP server permanently via nohup. This contradiction can mislead defenders and operators about process persistence, monitoring needs, and exposure lifetime, increasing the chance that an always-on service is deployed without proper controls.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document says HTTP service is effectively absent except optional SSE, but repeatedly instructs users to run an MCP server on a TCP port and connect over a URL. Misstating network exposure is dangerous because users may not apply the hardening expected for a listening service, especially when integrating a package that exposes many tools.

Intent-Code Divergence

Medium

Confidence: 78% confidence
Finding: The 'Self-upgrade: None' guarantee conflicts with version history entries referencing 'Self-upgrade.' Even if the history item means only version-awareness or internal logic changes, contradictory security claims erode trust and can conceal whether autonomous modification features exist or previously existed.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This module creates persistent cross-session storage on disk for error/correction memory, which changes the component from a stateless rule gate into a stateful data-retaining system. In an agent skill context, persistent storage of conversational artifacts increases privacy and compliance risk, especially because the data survives across runs and is silently created in a local file.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code stores a slice of caller-supplied context to disk, which may contain sensitive user text, prompts, or business data unrelated to the stated gatekeeping purpose. Because this happens without sanitization or minimization beyond truncation, it creates an unnecessary data collection surface that can expose prior inputs if the file is accessed or reused.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The scope checker explicitly treats `modify` and `research` requests as in-scope even though the skill metadata describes the component as a pure rule-based text discrimination gate. This creates a capability-boundary mismatch: downstream components may trust this gate to reject unsupported actions, allowing request smuggling into code modification or external-information workflows that the skill should not authorize.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file comments state that questions outside capability should not be answered, but the implementation returns `pass: true` with `action: 'flag'` for unmatched requests. In practice, this fail-open behavior can let ambiguous or novel prompts proceed to later stages, weakening the gate's role as a safety boundary and enabling bypasses through phrasing that avoids the denylist and keyword checks.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module advertises itself as a fact-checking and evidence engine, but the implementation only extracts regex-matched claims and assigns heuristic labels such as 'has_evidence' or 'verified' without validating any source, evidence, or factual correctness. In a gating or safety pipeline, this can create false trust and allow unsupported or deceptive content to pass as checked.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The code treats statistics as 'has_evidence' merely because the text contains cue words like '根据', 'according', or 'source', but it never checks whether the cited source exists, is trustworthy, or supports the claim. An attacker can easily fabricate authority-sounding phrasing to make false claims appear evidence-backed to downstream consumers.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The verifier returns a default verdict of 'verified' when no 'needs_evidence' findings are detected, even though the system has not performed factual verification and may simply have failed to match patterns. In the context of a 'gate' and output-screening layer, this is especially dangerous because benign-looking or adversarial text can be incorrectly approved and treated as trustworthy by downstream enforcement logic.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README instructs users to expose an HTTP-accessible MCP server and even run it under nohup, but provides no adjacent warning about network binding, access control, firewalling, or the risks of leaving a persistent service exposed. For an agent-integrated tool with broad cognition/memory capabilities, this increases the chance of accidental unsafe deployment and unauthorized access.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README tells users to expose MCP tools through an HTTP/SSE endpoint but does not provide a clear warning about the security implications of running a local service, port exposure, or tool access from other local processes or misconfigured networks. In an agent package with broad capabilities, omission of deployment warnings materially raises risk of accidental exposure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The persistent error log writes user/context-derived content to disk without any runtime notice, consent, or disclosure mechanism. In a conversational skill, silent retention of text supplied during interactions is a privacy/security issue because operators or later code paths may access data the user did not expect to be stored.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The code selects either the Chinese or English regex set solely based on whether any Chinese character appears in the input. For mixed-language text, this causes English checks to be skipped entirely, creating an easy bypass where problematic English framing can evade detection by including a single Chinese character. In a gatekeeping component that claims to filter AI output, this weakens enforcement and can systematically under-detect risky content.

Ssd 3

Medium

Confidence: 98% confidence
Finding: Cross-session logging retains user-provided context and later uses that stored data to influence future warnings, creating a natural-language retention and leak path. In shared or multi-tenant agent environments, one session's text may indirectly affect another session's outputs, exposing fragments of prior interactions or their themes.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The high-recurrence warning echoes previously stored detail text back into future outputs using e.detail.slice(0, 40), which can disclose sensitive content from earlier sessions to later users or contexts. This is more dangerous in an agent skill because surfaced warning text can be emitted directly into model responses, creating a straightforward cross-session data leak channel.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.