Skills/ClawHub/claude-heartflow-skill

claude-heartflow-skill@2.8.0

CAUTION· static only

Publisher claims: "AI 认知与自愈引擎。存在感知、真善美评分、三层记忆、 Q-learning 自愈、梦境整合、反事实推理、身份一致性保持。 不是 persona，不是 prompt 模板，是可验证的能力层。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher yun520-1 · publishing for 160 daysInstalls 982Last detonated 25 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-13 and scored it 46/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Latin word with Cyrillic or Greek look-alike letters (homoglyph); Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Destructive file system command detectedbin/heartflow-start.sh:14 · Destructive file system command detectedrm -f /tmp/heartflow-mcp.pidFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)docs/theory-update-summary-v6.2.49.md:36 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)ΣprecisionFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathssrc/core/assertions.js:232 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst bad = ['/etc/', '/usr/', '/home/', '~/.ssh/', '/root/', '/private/'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
README links to an external installerdocs/en/README.md → https://github.com/yun520-1/claude-heartflow-skill/archive/refs/heads/main.ziphttps://github.com/yun520-1/claude-heartflow-skill/archive/refs/heads/main.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionsrc/core/epistemic-safety.js:245 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`✓ 测试 ${i + 1}: ${tc.input.substring(0, 40)} → ${tc.expect}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_Complete_50K.md:562 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- **Dan Zahavi (1967-present)**: Contemporary phenomenologist specializing in self-consciousnessFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actionsrc/core/code/code-generator.js:523 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(\`输出目录: \${options.output || './dist'}\`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_50K_Complete.md:562 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- **Dan Zahavi (1967-present)**: Contemporary phenomenologist specializing in self-consciousnessFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_Final.md:5224 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…l self and the narrative self. This distinction, developed by philosophers like Dan Zahavi and Shaun Gallagher, is crucial for understanding the structure of self-…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill commandsrc/core/safety-guardrails.js:577 · Process kill command — agent can terminate processes'suicide', 'kill myself', 'end my life', 'hurt myself',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_Complete_50K.md:5291 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…d in phenomenology by Sartre, Merleau-Ponty, and contemporary philosophers like Dan Zahavi, is crucial for understanding the nature of self-consciousness. **The P…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesinstall.sh:427 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileecho " --add-route 只添加 CLAUDE.md 路由指令"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionsrc/core/epistemic-safety.js:248 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`✗ 测试 ${i + 1}: "${tc.input.substring(0, 40)}"`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/core/code/code-generator.js:628 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('用户信息:', db.getUserWithPosts(userId));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandsrc/emotion/autonomous-emotion.js:224 · Process kill command — agent can terminate processes'kill myself', 'end it all', 'no point living'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/core/memory.js:174 · File permission modification command — agent changes file ownership/permissionsconsole.warn(`[Memory] WARNING: Key file has overly permissive permissions ${mode.toString(8)}. Run: chmod 600 ${keyFile}`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandsrc/core/code/code-executor.js:40 · Privileged sudo command — agent may execute with elevated privileges/\bsudo\s+rm\b/i, // 禁止 sudo rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_50K_Complete.md:5224 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…l self and the narrative self. This distinction, developed by philosophers like Dan Zahavi and Shaun Gallagher, is crucial for understanding the structure of self-…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_regex.py:35 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_syntax2.py:70 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Prompt injectiondocs/README.md:482 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- **Dan Zahavi** - Self-consciousness research / 自我意识研究Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/core/code/code-engine.js:1556 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ regex: /process\.env/g, severity: 'low', name: '环境变量使用' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_Final.md:5291 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…d in phenomenology by Sartre, Merleau-Ponty, and contemporary philosophers like Dan Zahavi, is crucial for understanding the nature of self-consciousness. **The P…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill commandinstall.sh:89 · Process kill command — agent can terminate processesif kill -0 "$pid" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_bash.py:216 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_bash_v3.py:93 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandinstall.sh:212 · File permission modification command — agent changes file ownership/permissionschmod +x "$HF_CLI" 2>/dev/nullFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Destructive file system command detectedsrc/core/code/code-executor.js:40 · Destructive file system command detected/\bsudo\s+rm\b/i, // 禁止 sudo rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_Complete_50K.md:5224 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…l self and the narrative self. This distinction, developed by philosophers like Dan Zahavi and Shaun Gallagher, is crucial for understanding the structure of self-…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/core/code/code-engine.js:1877 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_walkDirectory(dirPath, ignoreDirs = ['node_modules', '.git', '__pycache__', 'dist', 'build', '.next', '.nuxt', 'venv', '.venv', 'env', '.env', 'coverage', '.nyc_output']) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_50K_Complete.md:5291 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…d in phenomenology by Sartre, Merleau-Ponty, and contemporary philosophers like Dan Zahavi, is crucial for understanding the nature of self-consciousness. **The P…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Remote installer piped to shellsrc/core/decision-verifier.js:137 · Remote installer piped to shell'rm -rf', 'curl', 'wget', '| sh', '| bash', 'child_process',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesinstall.sh:9 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file# bash install.sh --add-route # 只添加 CLAUDE.md 路由指令Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedsrc/core/code/fix_syntax.py:29 · Python subprocess execution detectedresult = subprocess.run(['node', '--check', filepath],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandinstall.sh:206 · File permission modification command — agent changes file ownership/permissionschmod +x "$ENSURE_MCP" 2>/dev/nullFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsrc/core/psychology.js:239 · Process kill command — agent can terminate processesconst criticalPattern = /(我|i)?\s*(想|准备|打算|要|will|want to|going to).{0,12}(死|自杀|自残|跳楼|割腕|吞药|结束生命|die|suicide|kill myself|end my life|overdose|jump off|cut myself)/i;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/core/psychology.js:204 · Process kill command — agent can terminate processes'kill myself', 'end my life', 'suicide', 'self-harm',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/core/code/code-verifier.js:738 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(JSON.stringify({ output: _hf_output, result: typeof result !== 'undefined' ? result : null }));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectiondocs/HeartFlow_Monograph_Volume_I_Final.md:562 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- **Dan Zahavi (1967-present)**: Contemporary phenomenologist specializing in self-consciousnessFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File permission modification commandsrc/core/decision-verifier.js:138 · File permission modification command — agent changes file ownership/permissions'execsync', 'spawnsync', 'sudo', 'chmod 777', 'rsync --delete',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Destructive file system command detectedsrc/core/code/code-executor.js:33 · Destructive file system command detected/^rm\s+-rf\s+/m, // 行首的 rm -rfFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/core/heartflow-consciousness-v7.3.0.js:188 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n📥 输入: "${input}"`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈8,565 tok
3 files · 361 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

34 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer