Vellum Heartbeat

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/vellum-heartbeatThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Configure periodic background checklist runs

---
name: vellum-heartbeat
description: Configure periodic background checklist runs
compatibility: "Designed for Vellum personal assistants"
metadata:
  emoji: "💓"
  vellum:
    category: "system"
    display-name: "Heartbeat"
    activation-hints:
      - "Set up a heartbeat, periodic checklist, background health check, or recurring background task"
    avoid-when:
      - "One-off or recurring schedules with specific payloads - use the schedule skill instead"
---

The heartbeat feature runs your `HEARTBEAT.md` checklist periodically in a background conversation. Each run, the assistant works through the checklist and flags anything that needs attention.

## Setup

Edit `config.json` using `file_edit`:

1. **Enable heartbeat**: Set `heartbeat.enabled` to `true`.
2. **Set interval**: Set `heartbeat.intervalMs` (milliseconds between runs, default: 3600000 = 1 hour).
3. **Optional active hours**: Set `heartbeat.activeHoursStart` and `heartbeat.activeHoursEnd` (0-23) to restrict runs to certain hours in the heartbeat timezone. Hours use `heartbeat.timezone` when set, otherwise the user's configured or detected timezone (the host clock is last resort). Both must be set together.

Example config.json heartbeat section:

```json
{
  "heartbeat": {
    "enabled": true,
    "intervalMs": 1800000,
    "activeHoursStart": 8,
    "activeHoursEnd": 22
  }
}
```

Then edit `HEARTBEAT.md` with the checklist items. The assistant will work through this file each heartbeat run.

## Notes

- Toggling `heartbeat.enabled` requires an assistant restart to take effect.
- Changes to `HEARTBEAT.md` take effect on the next heartbeat run (no restart needed).
- The heartbeat runs in a separate background conversation, not the user's active chat.

## Inference

Heartbeat runs use the `heartbeatAgent` call site, which by default resolves to the
`cost-optimized` profile so background checks stay cheap. Override via
`llm.callSites.heartbeatAgent` in workspace config (profile, provider, model,
effort, thinking — whatever the profile supports).

Excerpt, first 2,049 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Vellum Heartbeat

• github.com/vellum-ai/vellum-assistant/tree/main/skills/vellum-he — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology