Security audit
heartbeat-manager
Security checks for vulnerabilities and agentic risk
Overview
The skill's code, instructions, and optional network/credential usage are consistent with a heartbeat/monitoring manager; nothing in the bundle indicates intentional misdirection or hidden exfiltration, but the user must consciously configure and protect optional credentials and be cautious before enabling git push.
This skill appears to do what it says: periodic heartbeats, local workspace updates, optional Canvas/FSP sync, and optional email/gitting. Before installing or enabling features: 1) Review and secure config/.env — it will contain sensitive tokens/passwords (use app-specific passwords, restrict file permissions, do not store in cloud backups). 2) Do not enable git.auto_push until you trust the skill and have verified the configured git remote (auto_push is disabled by default). 3) Ensure you install all Python dependencies (including requests) in a controlled virtualenv. 4) If you do not want any network access, leave email/canvas/fsp monitoring disabled — the code skips these safely when tokens are missing. 5) Optionally run the code in an isolated environment (container/VM) the first time to observe behavior and validate logs. 6) Note: the code uses fcntl (POSIX file locking) and assumes a Unix-like environment; on Windows this may fail. If you want further assurance, request a line-by-line security review of modules that access credentials, network, and git (mail, canvas_monitor, fsp_monitor, site_monitor, git_ops).
SkillSpector findings are pending for this release.