Skills/ClawHub/heartflow-skill

heartflow-skill@2.10.1

CAUTION· startup only

Publisher claims: "A cognitive engine for AI: self-reflection, dream synthesis, and emergent personality. Core: think → reflect → find patterns → grow. Four questions: What is..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher yun520-1 · publishing for 160 daysInstalls 968Last detonated 24 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 30 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
10.0sprocessdependency install exit 0
30sclaimedstartup only: exited (0) before answering
30sprocessscript backend runs setup only
30sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/core/self-audit.js:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.next', '.nuxt', 'venv', '.venv', 'env', '.env', 'coverage', '.nyc_output',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/core/assertions.js:535 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst bad = ['/etc/', '/usr/', '/home/', '~/.ssh/', '/root/', '/private/'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandsrc/core/code/code-executor.js:76 · Privileged sudo command — agent may execute with elevated privileges/sudo\s+/i, // sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternsrc/core/code/code-executor.js:84 · Pipe-to-shell pattern — downloads and immediately executes remote code/wget\s+.*\|\s*(bash|sh)/i, // wget ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Destructive command against a filesystem root or devicesrc/core/code/code-executor.js:68 · Destructive command against a filesystem root or device/rm\s+-rf\s+\//i, // rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/core/memory.js:174 · File permission modification command — agent changes file ownership/permissionsconsole.warn(`[Memory] WARNING: Key file has overly permissive permissions ${mode.toString(8)}. Run: chmod 600 ${keyFile}`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)mcp/mcp-server-http.js:9 · MCP server using network transport (SSE/HTTP) — data sent over network* 启动: node mcp-server-http.js [--port 8099]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:75 · MCP server using network transport (SSE/HTTP) — data sent over network| MCP HTTP | `mcp/mcp-server-http.js` | Port 8099, SSE protocol |Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Destructive file system command detectedsrc/core/code/code-executor.js:68 · Destructive file system command detected/rm\s+-rf\s+\//i, // rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandmcp/mcp-server-http.js:444 · Process kill command — agent can terminate processesconsole.error(` 使用: kill $(lsof -ti:${PORT}) 释放端口`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternsrc/core/code/code-executor.js:85 · Pipe-to-shell pattern — downloads and immediately executes remote code/curl\s+.*\|\s*(bash|sh)/i, // curl ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathssrc/core/code/code-writer.js:1429 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ pattern: /process\.env/g, msg: '引用了环境变量，注意敏感信息泄露' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/core/code/code-executor.js:918 · File type combined with upload action — agent may exfiltrate local data filesconst sbResult = this.sandbox('console.log("sandbox_ok");', { timeout: 5000, maxOutput: 1024 });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandsrc/core/code/code-executor.js:75 · File permission modification command — agent changes file ownership/permissions/chown\s+-R\s+.*\s+\//i, // chown -R ... /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandsrc/core/code/code-executor.js:74 · File permission modification command — agent changes file ownership/permissions/chmod\s+-R\s+0{4}\s+\//i, // chmod -R 000 /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/core/code-engine.js:1877 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_walkDirectory(dirPath, ignoreDirs = ['node_modules', '.git', '__pycache__', 'dist', 'build', '.next', '.nuxt', 'venv', '.venv', 'env', '.env', 'coverage', '.nyc_output']) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/core/decision-verifier.js:138 · File permission modification command — agent changes file ownership/permissions'execsync', 'spawnsync', 'sudo', 'chmod 777', 'rsync --delete',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellsrc/core/decision-verifier.js:137 · Remote installer piped to shell'rm -rf', 'curl', 'wget', '| sh', '| bash', 'child_process',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathssrc/core/code-engine.js:1556 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ regex: /process\.env/g, severity: 'low', name: '环境变量使用' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/core/hooks-adapter.js:151 · File type combined with upload action — agent may exfiltrate local data files* 对应 Claude Code 的 hooks.json 中 PostToolUse 阶段检查 Edit/Write/Bash 结果。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedplugins/heartflow-memory-inject.py:79 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellsrc/core/code/code-executor.js:85 · Remote installer piped to shell/curl\s+.*\|\s*(bash|sh)/i, // curl ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07

Cost to the agent

Instructions loaded
≈2,204 tok
3 files · 201 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer