Security audit

heartflow-engine

Security checks across malware telemetry and agentic risk

Overview

HeartFlow is a legitimate-looking local AI guardrail, but it asks for review because its real runtime stores state, manages credentials, and exposes a large localhost MCP surface more broadly than its read-only rule-engine framing suggests.

Review this skill as a stateful local MCP service, not just a passive text checker. Install only if you are comfortable with local memory/log files, a localhost authenticated server, plaintext .env token handling, and a broad tool surface; run it in a contained project and set explicit token, path-guard, persistence, and network settings before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (118)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares no permissions while the analyzed implementation reportedly has capabilities for environment access, filesystem read/write, networking, and shell-like execution. That mismatch is dangerous because users and orchestrators may grant or invoke the skill under a low-trust assumption, while the actual runtime can access sensitive data, modify files, or reach external systems.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a severe description-behavior mismatch: the skill presents itself as a pure rule-based judge with code execution and filesystem write disabled by default, yet the analyzed code reportedly exposes an HTTP server, persistent storage, network access, plugin/mutation systems, and execution-oriented components. In a security-sensitive 'guardrail' skill, hidden or understated capabilities are especially risky because operators may trust it with sensitive prompts, memory, and decisions while it can persist, modify, or exfiltrate data outside the claimed safety boundary.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The README presents the package as a narrowly scoped rule-based discriminator, yet later advertises much broader capabilities such as memory management, dream, evolution, identity, and formula engines. This mismatch increases the risk that operators will grant the skill more trust, permissions, or integration scope than intended, creating a deceptive security posture and making downstream misuse easier.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The README explicitly claims the system 'does not generate text' and 'does not reason,' but elsewhere documents components like rewriter, think, think_fast, and decision_router that imply generation or higher-order decision support. Contradictory capability claims are dangerous because security reviewers and users may under-assess the system's autonomy, attack surface, and potential for unsafe outputs or hidden behaviors.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: Documented persistent memory and explicit data-erasure capabilities exceed the stated purpose of a text discrimination gate and imply stateful handling of potentially sensitive user data. Without tight scoping and justification, such features can expand the attack surface, enable unauthorized retention or deletion, and mislead users about the package's real trust requirements.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The script explicitly opens and overwrites src/index.js, which contradicts the skill metadata claim that file-system writes are disabled by default. Even if this is a maintenance helper rather than runtime behavior, undisclosed source-rewriting capability increases supply-chain risk because it can silently alter shipped detection logic.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This file performs a direct write to `src/index.js`, modifying project source code on disk. That capability is inconsistent with the stated role of the skill as a deterministic judgment/rule engine and creates integrity risk: if invoked in an automated workflow, it can silently alter detection logic and potentially weaken or corrupt security behavior.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The code writes to `src/index.js` even though the skill metadata states that filesystem writing is disabled by default. This mismatch between declared safety boundaries and actual behavior is dangerous because operators may trust the manifest and grant the skill access under false assumptions, enabling unauthorized modification of project code.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script directly rewrites src/index.js, which contradicts the stated safety boundary that file-system writing is disabled by default for this skill. In a security-sensitive 'judgment engine' context, hidden or undocumented source modification is dangerous because it changes code behavior rather than only analyzing it, and could be repurposed to tamper with detection logic or weaken safeguards.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The comment claims a narrow whitespace-only adjustment, but the actual replacement introduces .*?, which materially broadens the regex and can change matching behavior beyond the stated intent. In a rule engine that claims deterministic safety judgments, this kind of silent semantic widening can cause overmatching, missed distinctions, or weakened detection quality, especially around sensitive secret-related patterns.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code persists self-generated rules to disk via saveRules(), which contradicts the skill metadata claiming file-system writes are disabled by default and that the engine is a deterministic rule engine. This creates hidden mutable state and a trust-boundary violation: behavior can change over time without explicit user approval or clear operator awareness.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation says rules are created after the same error repeats 3+ times, but the implementation uses a global highRecurrence flag, allowing unrelated categories to gain new rules even when that category itself did not recur. This can silently broaden enforcement, causing incorrect blocking or alerting and making the engine's behavior less predictable and less trustworthy.

Description-Behavior Mismatch

High

Confidence: 87% confidence
Finding: The skill is described as a deterministic judgment engine, but this module includes generalized memory read/write management, expanding scope beyond evaluation into stateful system interaction. That broader capability increases attack surface and may enable unintended data access or persistence not expected from the skill's stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill is described as a deterministic judgment engine, but this module includes generalized memory read/write management, expanding scope beyond evaluation into stateful system interaction. That broader capability increases attack surface and may enable unintended data access or persistence not expected from the skill's stated purpose.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: loadCapabilitiesFromConfig reads external JSON and registers cap.execute directly as executable behavior, effectively allowing untrusted configuration to define callable capabilities. In a security-sensitive rule engine, this enables capability injection and breaks determinism, especially if upstream code supplies deserialized functions or adapter-mediated execution hooks.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This engine is advertised as a deterministic arbiter for correctness and safety, but its conflict-resolution logic is optimized for harmony and can explicitly yield to the user's position under tension. In a safety-gating role, that mismatch can let harmful, incorrect, or policy-violating user requests pass because the system de-escalates instead of making a firm safety determination.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The code claims a 'real second pass' reasoning-quality check, but the implementation is only keyword matching for a few Chinese phrases. If downstream systems trust this as robust reasoning validation, attackers or unsafe inputs can easily evade detection, creating a false sense of safety and weakening any guardrail built on top of it.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The module frames itself as cooperative arbitration that finds win-win outcomes, but the actual ACCOMMODATION path simply yields to the user when tension is high. In a skill whose stated purpose includes judging safety, this behavior can bias decisions toward compliance under pressure, exactly when strong refusal behavior may be needed.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The module exposes a save(filePath) method that writes JSON data to an arbitrary caller-supplied path, which directly conflicts with the stated safety boundary that file-system writes are disabled by default. If untrusted input can influence filePath, this creates a path/overwrite primitive that can modify files outside the intended storage area and weakens the trustworthiness of the skill's safety claims.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The documentation claims the module performs stronger runtime honesty checks and 'rejects' collapsed dual perspectives, but the implementation only detects identical function references and still executes both functions before downgrading the result. In a safety-critical auditor, this mismatch can mislead integrators into trusting an independence guarantee that does not exist, allowing a single implementation or near-identical wrappers to masquerade as corroborating perspectives and inflate trust in outcomes.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The behavior subsystem writes dialogue-derived state to disk (`dialogue-history.jsonl`, `.last-dream`, and memory entries) despite the skill metadata claiming file-system writing is disabled by default. In a security-sensitive agent skill, this mismatch is dangerous because operators may trust the manifest and deploy the skill in contexts where persistence of user data is prohibited, creating silent privacy and policy violations.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata promises a pure judgment/rule engine with code execution and file-system writing disabled by default, yet the constructor exposes lazy-loadable codeExecutor, codePlanner, codeWriter, and persistent memory components. Even if these modules are not immediately instantiated, registering them as first-class capabilities materially expands the attack surface and can mislead integrators into granting the skill more trust or permissions than its manifest justifies.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: Including code execution/planning modules in a skill presented as a deterministic evaluator creates a privilege/scope mismatch. In a security-sensitive setting, users may route untrusted content into this skill assuming it cannot author or execute code, so hidden or undocumented code-oriented modules increase the risk of unsafe activation, chaining, or future misuse.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The presence of selfInitiator, goalPursuer, desireEngine, and curiosityEngine conflicts with the declared model of a deterministic rule engine and introduces autonomy-oriented behavior surfaces. In the context of a judgment skill, autonomous subsystems are more dangerous because operators may not expect initiative-taking or goal-seeking logic, which can undermine containment assumptions and policy review.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The lifecycle code seeds mandatory core rules that instruct downstream behavior to perform external web and curl-based retrieval, which expands the skill's effective capability beyond the declared 'pure rule engine' boundary. In a security-sensitive agent, hidden or undocumented network-oriented guidance can drive unexpected data egress, policy bypass attempts, or unsafe tool invocation by other components that consume these rules as normative instructions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/mcp-server.js:4854

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test_all_cats.cjs:14

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test_final.cjs:43

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test_security.cjs:11

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test_security.mjs:11

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: test_all_cats.cjs:42

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: test_final.cjs:45

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: test_security.cjs:23

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: test_security.mjs:23

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:108