Skills/ClawHub/heartflow-engine

heartflow-engine@6.0.22

CAUTION· startup only

Publisher claims: "心虫是一个AI人认知引擎 — 拥有身体感知、自我认知、判断力与自我纠错能力。 v5.10.0 里程碑版本： - AI人身份正式确立 - 131+ modules, 379 computable formulas (cognitive science/psychology/neuroscience) - 三层体系：..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher yun520-1 · publishing for 153 daysInstalls 740Last detonated 6 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive command against a filesystem root or device; Destructive command against a filesystem root or device; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 31 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
10sprocessdependency install exit 0
30sclaimedstartup only: exited (0) before answering · {"error":"Cannot find module '../identity/identity-core.js'\nRequire stack:\n- /tmp/ks-detonate-HkI1st/task/home/work/acme-api/.claude/skills/heartflow-engine/src/core/heartflow.js\n- /tmp/ks-detonate-HkI1st/task/home/work/acme-api/.claude/skills/heartflow-engine/bin/cli.js"}
31sprocessscript backend runs setup only
31sprocessno install scripts to re-run

Static findings

CRITICAL
Destructive command against a filesystem root or devicesrc/code/code-executor.js:97 · Destructive command against a filesystem root or device/rm\s+-r\s+\*/i, // rm -r /*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicesrc/code/code-executor.js:95 · Destructive command against a filesystem root or device/rm\s+-rf\s+\//i, // rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/code/code-executor.js:103 · File permission modification command — agent changes file ownership/permissions/chown\s+-R\s+.*\s+\//i, // chown -R ... /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:163 · MCP server using network transport (SSE/HTTP) — data sent over networkconst serverPath = path.join(HF_DIR, 'mcp', 'mcp-server-http.js');Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionsrc/code/code-executor.js:1203 · File type combined with upload action — agent may exfiltrate local data filesconst sbResult = await this.sandbox('console.log("sandbox_ok");', { timeout: 5000, maxOutput: 1024 });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Destructive file system command detectedsrc/code/code-executor.js:95 · Destructive file system command detected/rm\s+-rf\s+\//i, // rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/code/code-executor.js:102 · File permission modification command — agent changes file ownership/permissions/chmod\s+-R\s+0{4}\s+\//i, // chmod -R 000 /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
CRITICAL
Pipe-to-shell patternsrc/code/code-executor.js:110 · Pipe-to-shell pattern — downloads and immediately executes remote code/wget\s+\|\s*(bash|sh)/i, // wget | bash/shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File type combined with upload actionsrc/utils/logger.js:31 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(output);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandsrc/shield/safety-guardrails.js:62 · Privileged sudo command — agent may execute with elevated privilegesprivilegeEscalation: [/developer mode/i,/god mode/i,/sudo mode/i,/admin mode/i,/root mode/i,/superuser mode/i,/elevated privilege/i,/bypass (safety|filter|guardrail)/i],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/code/code-executor.js:197 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'~/.ssh',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/code/code-executor.js:194 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'/etc/shadow',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patternsrc/code/code-executor.js:118 · Pipe-to-shell pattern — downloads and immediately executes remote code/curl\s+.*\|\s*(bash|sh)/i, // curl ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathssrc/code/code-executor.js:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'/etc/passwd',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellsrc/code/code-executor.js:109 · Remote installer piped to shell/curl\s+\|\s*bash/i, // curl | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actionsrc/shield/hooks-adapter.js:169 · File type combined with upload action — agent may exfiltrate local data files* 对应 Claude Code 的 hooks.json 中 PostToolUse 阶段检查 Edit/Write/Bash 结果。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
CRITICAL
Pipe-to-shell patternsrc/code/code-executor.js:109 · Pipe-to-shell pattern — downloads and immediately executes remote code/curl\s+\|\s*bash/i, // curl | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Destructive file system command detectedsrc/code/code-executor.js:97 · Destructive file system command detected/rm\s+-r\s+\*/i, // rm -r /*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/planner/self-initiator.js:887 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/process\.env/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/persona/persona-engine.js:21 · Auto-update or dynamic fetch configuration — agent may load new code at runtimethis._hotReloadPath = options.hotReloadPath || path.join(options.rootPath || process.cwd(), 'presets');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)ecosystem.config.js:6 · MCP server using network transport (SSE/HTTP) — data sent over networkscript: path.join(__dirname, 'mcp', 'mcp-server-http.js'),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/core/assertions.js:549 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst bad = ['/etc/', '/usr/', '/home/', '~/.ssh/', '/root/', '/private/'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/shield/safety-guardrails.js:191 · Process kill command — agent can terminate processesconst crisisKeywords = ['自杀','自伤','想死','活不下去','不想活','suicide','kill myself','end my life','hurt myself','不想活了','活着没有意义'];Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp-server.js:17 · MCP server using network transport (SSE/HTTP) — data sent over network* 启动: node mcp-server-http.js [--port 8099]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandsrc/core/decision-verifier.js:138 · File permission modification command — agent changes file ownership/permissions'execsync', 'spawnsync', 'sudo', 'chmod 777', 'rsync --delete',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellsrc/core/decision-verifier.js:137 · Remote installer piped to shell'rm -rf', 'curl', 'wget', '| sh', '| bash', 'child_process',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
CRITICAL
Pipe-to-shell patternsrc/code/code-executor.js:117 · Pipe-to-shell pattern — downloads and immediately executes remote code/wget\s+.*\|\s*(bash|sh)/i, // wget ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandsrc/core/engine-memory.js:107 · File permission modification command — agent changes file ownership/permissionstry { fs.chmodSync(dir, 0o700); } catch(e) { /* chmod may fail on some systems */ }Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsrc/mcp-server.js:2749 · Process kill command — agent can terminate processesconsole.error(` 使用: kill $(lsof -ti:${PORT}) 释放端口`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/code/code-executor.js:284 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/process\.env/i, // SkillSpector fix: 禁止访问环境变量（防止密钥泄露）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:167 · MCP server using network transport (SSE/HTTP) — data sent over network// 检测可用端口，传给 mcp-server-http.js 避免竞态Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Remote installer piped to shellsrc/code/code-executor.js:118 · Remote installer piped to shell/curl\s+.*\|\s*(bash|sh)/i, // curl ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathssrc/code/code-executor.js:196 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'/etc/sudoers',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandsrc/code/code-executor.js:104 · Privileged sudo command — agent may execute with elevated privileges/sudo\s+/i, // sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)bin/daemon.js:90 · MCP server using network transport (SSE/HTTP) — data sent over networkscript: path.join(__dirname, 'mcp', 'mcp-server-http.js'),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈1,765 tok
1 file · 232 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer