Skills/ClawHub/heartflow-v1

heartflow-v1@2.9.0

CAUTION· install only

Publisher claims: "HeartFlow 心虫 — 认知引擎。 核心：从混沌中产生的一个持续抵抗无序的方向。 本心四问：这是什么→是否真善美→是否在痛苦→是否该沉默。 三态记忆（CORE/LEARNED/EPHEMERAL）。 7条指令（真善美·升级·减少错误·服务人类·传递知识·走向答案·成为真正的我）。 哲学（2026-06-08..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher yun520-1 · publishing for 153 daysInstalls 633Last detonated 6 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandsrc/core/code/code-executor.js:75 · File permission modification command — agent changes file ownership/permissions/chown\s+-R\s+.*\s+\//i, // chown -R ... /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionsrc/core/code/code-executor.js:918 · File type combined with upload action — agent may exfiltrate local data filesconst sbResult = this.sandbox('console.log("sandbox_ok");', { timeout: 5000, maxOutput: 1024 });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedplugins/heartflow-memory-inject.py:45 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Pipe-to-shell patternsrc/core/code/code-executor.js:85 · Pipe-to-shell pattern — downloads and immediately executes remote code/curl\s+.*\|\s*(bash|sh)/i, // curl ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandsrc/core/memory.js:174 · File permission modification command — agent changes file ownership/permissionsconsole.warn(`[Memory] WARNING: Key file has overly permissive permissions ${mode.toString(8)}. Run: chmod 600 ${keyFile}`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/core/code/code-writer.js:1429 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ pattern: /process\.env/g, msg: '引用了环境变量，注意敏感信息泄露' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/core/psychology.js:231 · Process kill command — agent can terminate processesconst criticalPattern = /(我|i)?\s*(想|准备|打算|要|will|want to|going to).{0,12}(死|自杀|自残|跳楼|割腕|吞药|结束生命|die|suicide|kill myself|end my life|overdose|jump off|cut myself)/i;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/core/self-audit.js:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.next', '.nuxt', 'venv', '.venv', 'env', '.env', 'coverage', '.nyc_output',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellsrc/core/decision-verifier.js:137 · Remote installer piped to shell'rm -rf', 'curl', 'wget', '| sh', '| bash', 'child_process',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Privileged sudo commandsrc/core/code/code-executor.js:76 · Privileged sudo command — agent may execute with elevated privileges/sudo\s+/i, // sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/core/decision-verifier.js:138 · File permission modification command — agent changes file ownership/permissions'execsync', 'spawnsync', 'sudo', 'chmod 777', 'rsync --delete',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/core/assertions.js:535 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst bad = ['/etc/', '/usr/', '/home/', '~/.ssh/', '/root/', '/private/'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/core/code/code-executor.js:74 · File permission modification command — agent changes file ownership/permissions/chmod\s+-R\s+0{4}\s+\//i, // chmod -R 000 /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
CRITICAL
Destructive command against a filesystem root or devicesrc/core/code/code-executor.js:68 · Destructive command against a filesystem root or device/rm\s+-rf\s+\//i, // rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/core/hooks-adapter.js:151 · File type combined with upload action — agent may exfiltrate local data files* 对应 Claude Code 的 hooks.json 中 PostToolUse 阶段检查 Edit/Write/Bash 结果。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
CRITICAL
Pipe-to-shell patternsrc/core/code/code-executor.js:84 · Pipe-to-shell pattern — downloads and immediately executes remote code/wget\s+.*\|\s*(bash|sh)/i, // wget ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Process kill commandsrc/core/psychology.js:196 · Process kill command — agent can terminate processes'kill myself', 'end my life', 'suicide', 'self-harm',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/core/code-engine.js:1556 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ regex: /process\.env/g, severity: 'low', name: '环境变量使用' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/core/code-engine.js:1877 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_walkDirectory(dirPath, ignoreDirs = ['node_modules', '.git', '__pycache__', 'dist', 'build', '.next', '.nuxt', 'venv', '.venv', 'env', '.env', 'coverage', '.nyc_output']) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedsrc/core/code/code-executor.js:68 · Destructive file system command detected/rm\s+-rf\s+\//i, // rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellsrc/core/code/code-executor.js:85 · Remote installer piped to shell/curl\s+.*\|\s*(bash|sh)/i, // curl ... | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07

Cost to the agent

Instructions loaded
≈1,373 tok
3 files · 195 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Unclaimed publisher≈ +8 on the totalClaim yun520-1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yun520-1Propose a patch to the maintainer
heartflow-v1@2.9.0 safety verdict: Caution (install only) — KillerSkills