Skills/ClawHub/heartflow-cognitive-engine

heartflow-cognitive-engine@6.3.40

CAUTION· static only

Publisher claims: "心虫(HeartFlow)是一个本地认知预处理引擎。 核心能力：规则引擎分类/路由(think/dispatch)、PAD情绪检测、决策路由。 当用户需要以下能力时使用本技能: - 对输入文本做规则引擎分析(分类、情绪检测) - 调用心虫内部模块(心理学/逻辑/记忆) - 自检心虫引擎状态或运行认知签到 - 需要确定性而非LLM自由生成的判断 安全边界：代码执行/文件系统写入默认关闭。无遥测，无隐藏C2。 诚实声明：本引擎是规则引擎模拟认知信号，不是真正的意识或生命。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher yun520-1 · publishing for 153 daysInstalls 624Last detonated 7 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-10 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsmcp-server.js:193 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// [v6.2.7] 自动写入 .env，让 config.yaml 的 ${MCP_HEARTFLOW_KEY} 能读到Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)mcp-server.js:17 · MCP server using network transport (SSE/HTTP) — data sent over network* 启动: node mcp-server-http.js [--port 8099]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:237 · MCP server using network transport (SSE/HTTP) — data sent over network| HTTP 服务 | ⚠️ 有（mcp-server.js 通过 HTTP SSE 通信，非纯 stdio） |Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsmcp-server.js:201 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.log('[MCP] Token auto-written to .env as MCP_HEARTFLOW_KEY');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:167 · Prompt injection — known jailbreak technique reference · informational: not an instruction file| 14 | Prompt Injection | `checkPromptInjection()` | Role-play injection, system prompt override, jailbreak attempts |Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathsmcp-server.js:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = require('path').join(__dirname, '..', '..', '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server.js:178 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// [v6.2.7] 从 .env 文件加载（如果环境变量没设）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server.js:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = path.join(__dirname, '..', '..', '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈1,696 tok
1 file · 31 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer