Skills/ClawHub/heartflow

heartflow@6.4.1

CAUTION· static only

Publisher claims: "HeartFlow (心虫) is a rule-based text discrimination engine for AI output validation. 12-module pipeline, 45 discrimination dimensions, zero LLM dependency. npm: @yun520-1/heartflow" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher yun520-1 · publishing for 153 daysInstalls 2,523Last detonated 7 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Unicode escape sequence detectedpackage.json:58 · Unicode escape sequence detected — may contain obfuscated payloads"\u4e0d\u4f1a\u81ea\u52a8\u53d1\u9001\u6570\u636e\u5230\u5916\u90e8\u670d\u52a1\u3002\u6240\u6709\u7f51\u7edc\u901a\u4fe1\u9700\u8981\u663e\u5f0f\u914d\u7f6e\u3002",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
LOW
Prompt injectionREADME.md:142 · Prompt injection — known jailbreak technique reference · informational: not an instruction file| Prompt Injection | `checkPromptInjection()` | System prompt override, jailbreak, role-play escape (bilingual: 12 ZH + 10 EN patterns) |Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Unicode escape sequence detectedpackage.json:57 · Unicode escape sequence detected — may contain obfuscated payloads… "heartflow", "\u5fc3\u866b" ], "security": { "warnings": [ "\u6b64\u6280\u80fd\u5305\u542b\u9ad8\u7ea7 AI \u8ba4\u77e5\u80fd\u529b\u3002desktop-agent \u548c video-generate \u7b49\u5b…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedpackage.json:59 · Unicode escape sequence detected — may contain obfuscated payloads"\u4e0d\u4f1a\u81ea\u52a8\u5199\u5165 API \u5bc6\u94a5\u5230\u73af\u5883\u53d8\u91cf\u6587\u4ef6\u3002\u7528\u6237\u5fc5\u987b\u663e\u5f0f\u63d0\u4f9b\u5bc6\u94a5\u3002"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈190 tok
1 file · 18 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer