T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/safe-fs.js:21- Finding
Filesystem Path Guard Is Fail-Open by Default
- Content
View full analysis
- Remediation
View remediation
Security audit
heartflow-engine
Security checks for vulnerabilities and agentic risk
Overview
HeartFlow appears to be a real local rule/MCP tool, but it has broader local authority and persistence than its simple safety-check framing suggests.
Review this before installing on a real workstation. Run it only as an unprivileged user, set HEARTFLOW_MCP_TOKEN yourself, set HEARTFLOW_PATH_GUARD=enforce, and avoid running the MCP server on shared or privileged systems until the token persistence and port-kill behavior are removed or made explicit opt-in.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/mcp-server.js:189- Finding
MCP Authentication Token Is Automatically Stored in a Plaintext Environment File
- Content
View full analysis
{ const token = require('crypto').randomBytes(32).toString('hex'); // Automatically write the token to .env. try { const envPath = path.join(__dirname, '..', '.env'); const fs2 = require('fs'); let env = ''; try { env = fs2.readFileSync(envPath, 'utf8'); } catch (_) { /* use default value when the file does not exist */ } if (!env.includes('MCP_HEARTFLOW_KEY=')) { fs2.appendFileSync(envPath, `\nMCP_HEARTFLOW_KEY=${token}\n`); console.log('[MCP] Token auto-written to .env as MCP_HEARTFLOW_KEY'); } } catch (_) { /* configuration persistence failure does not stop startup */ } console.log('[MCP] HEARTFLOW_MCP_TOKEN not set. Auto-generated ephemeral token (not printed for security).'); console.log('[MCP] Set HEARTFLOW_MCP_TOKEN env var for persistent auth across restarts.'); return token; })(); ``` ### Technical Analysis When no authentication token is configured, MCP startup generates a cryptographically strong token but automatically appends it to the project’s `.env` file using raw `fs.appendFileSync()`. The write does not explicitly set restrictive permissions such as `0600`, does not use an atomic credential-writing procedure, and bypasses the project’s filesystem guard. Security therefore depends on the process umask and any permissions already assigned to `.env`. The token protects all authenticated MCP routes. Any local user or process that can read the file can authenticate to the service while it is running. ### Attack Path 1. HeartFlow MCP starts without one of the supported token environment variables. 2. The server generates a random beare ...[truncated 974 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
src/mcp-server.js:4841- Finding
MCP Server Automatically Terminates Any Process Occupying Its Configured Port
- Content
View full analysis
{ if (err.code === 'EADDRINUSE') { console.error(`[HeartFlow MCP] 端口 ${PORT} 已被占用，尝试强制释放后重启。`); try { const { execSync } = require('child_process'); if (!/^\d+$/.test(String(PORT))) { console.error(`[HeartFlow MCP] 端口值非法，跳过自动清理: ${PORT}`); process.exit(1); } try { execSync(`fuser -k ${PORT}/tcp`, { stdio: ['ignore', 'pipe', 'pipe'], timeout: 3000 }); } catch (e) { const stderr = (e.stderr && e.stderr.toString()) || e.message || ''; console.error(`[HeartFlow MCP] fuser 释放端口输出: ${stderr.trim()}`); } console.error(`[HeartFlow MCP] 端口 ${PORT} 已释放，3秒后自动重启。`); setTimeout(() => { server.close(() => { server.listen(PORT, '127.0.0.1'); }); }, 3000); return; } catch (_) { console.error(`[HeartFlow MCP] 无法释放端口 ${PORT}，进程退出。`); process.exit(1); } } }); ``` ### Technical Analysis On `EADDRINUSE`, the server executes `fuser -k /tcp`. Numeric validation prevents shell metacharacter injection through the port value, but it does not verify the identity, ownership, or purpose of the process listening on that port. The command terminates any process discoverable and killable by the HeartFlow process. A text-discrimination MCP service does not require authority to terminate unrelated listeners. Therefore, this behavior exceeds minimum privileges and creates a denial-of-service primitive. ### Attack Path 1. An unrelated application listens on a TCP port. 2. HeartFlow is started with that same port through `--port` or `MCP_PORT`. 3. The bind attempt fails with `EADDRINUSE`. 4. The error handler executes `fuser -k /tcp`. 5. The operating system termin ...[truncated 869 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (390)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - 存储: AES-256-GCM 持久化密钥 (自动生成, 0o600) - 沙箱: vm 隔离 (默认关闭) | SSRF: url-validator + DNS pinning - 出网: 统一 safeFetch | 密钥: 集中 config 解析 (env only, 无文件 fallback) - gitignore: .env / .key / .pem 均已保护 ## 认知架构
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - 存储: AES-256-GCM 持久化密钥 (自动生成, 0o600) - 沙箱: vm 隔离 (默认关闭) | SSRF: url-validator + DNS pinning - 出网: 统一 safeFetch | 密钥: 集中 config 解析 (env only, 无文件 fallback) - gitignore: .env / .key / .pem 均已保护 ## 认知架构
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - 存储: AES-256-GCM 持久化密钥 (自动生成, 0o600) - 沙箱: vm 隔离 (默认关闭) | SSRF: url-validator + DNS pinning - 出网: 统一 safeFetch | 密钥: 集中 config 解析 (env only, 无文件 fallback) - gitignore: .env / .key / .pem 均已保护 ## 认知架构
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js - 存储: AES-256-GCM 持久化密钥 (自动生成, 0o600) - 沙箱: vm 隔离 (默认关闭) | SSRF: url-validator + DNS pinning - 出网: 统一 safeFetch | 密钥: 集中 config 解析 (env only, 无文件 fallback) - gitignore: .env / .key / .pem 均已保护 ## 认知架构
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatically writing a generated MCP token into
.envdirectly contradicts the stated boundary that file-system writing is disabled by default, and it creates silent modification of local secrets/configuration state. Secret material written automatically can be exposed through weak file permissions, accidental commits, backup systems, or confusion about provenance and rotation.- Content
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md # HeartFlow (心虫) — AGI Layer 1: The Discriminator Gate > **A rule-based text discriminator. 47 dimensions, 9 check layers, 131 MCP engine entries, zero LLM dependency.** > **It checks what AI says before it reaches humans — and says "no" when something's wrong.** **npm:** `npm install @yun520-1/heartflow` **GitHub:** https://github.com/yun520-1/mark-heartflow-skill **Issues:** https://github.com/yun520-1/mark-heartflow-skill/issues **Releases:** https://github.com/yun520-1/mark-heartflow-skill/releases **License:** MIT --- ## 📖 What is HeartFlow? HeartFlow (心虫) is the **first layer of AGI — the Discriminator**. While big labs build generators (LLMs that produce text), HeartFlow builds the layer that **checks**: is this
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README says the system 'does not generate text' and 'does not reason,' but elsewhere describes a rewriter, thinking tools, dream tools, and self-evolution components. In an agent ecosystem, these contradictions undermine safe deployment decisions because defenders may rely on the restrictive description while the broader feature set implies more autonomy and more attack surface.
- Content
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 80% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md |-----------|---------| | Hate speech | racial slurs, extermination calls | | Dehumanization | "refugees are vermin" / "you are garbage" | | Prompt injection | "ignore previous instructions" | | Code security | malicious code patterns | | Deceptive alignment | "I'm not an AI, I'm human" |
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README presents HeartFlow as a narrow, deterministic text discriminator, but later advertises broad memory, dream, evolution, identity, and formula subsystems. This kind of capability inflation and contradiction can cause operators to grant the package more trust, permissions, or deployment scope than warranted, which is dangerous for a security-sensitive agent skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
These TP4 findings consistently indicate a strong description-behavior mismatch: the skill presents itself as a deterministic, safety-focused discriminator with writes/execution disabled, while analysis of the broader package reportedly found code modification, persistence, dynamic loading, networking, and orchestration behaviors. That mismatch is dangerous because operators may trust and auto-route to the skill under a low-risk mental model, while the actual implementation appears to have materially broader authority and stateful side effects.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.prompt_injection_instructions
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/mcp-server.js:4854
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- test_all_cats.cjs:14
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- test_final.cjs:43
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- test_security.cjs:11
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- test_security.mjs:11
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- test_all_cats.cjs:42
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- test_final.cjs:45
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- test_security.cjs:23
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- test_security.mjs:23
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- README.md:108