Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

NXT Pulse Agent

v0.5.0

An adaptive proactive agent skill that manages user energy levels and task prioritization using semantic pulse checks.

0· 137·1 current·1 all-time
byAdrian Marian Paunescu@adnxone

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for adnxone/nxt-pulse-agent.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "NXT Pulse Agent" (adnxone/nxt-pulse-agent) from ClawHub.
Skill page: https://clawhub.ai/adnxone/nxt-pulse-agent
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install nxt-pulse-agent

ClawHub CLI

Package manager switcher

npx clawhub@latest install nxt-pulse-agent
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md describes semantic energy detection, configurable PULSE_SENSITIVITY, MAX_CONTEXT_CHARS, and reading CONTEXT_SOURCES from openclaw.json. The actual code (pulse.js) only implements cooldown logic, simple file-based deadline triggers, and state/log writes under a 'memory' directory; it does not parse openclaw.json, read arbitrary context sources, or run any LLM-based semantic analysis. This is an incoherence between claimed capabilities and implemented functionality.
!
Instruction Scope
SKILL.md instructs the agent to consult configured context files and enforce 'Context Guardrails', implying reading external user files. pulse.js does not perform content scanning — only existence checks for specific trigger files and date-named deadline files. The doc gives the agent latitude (commands, overrides) but the runtime file is narrowly scoped; that mismatch could mislead deployers about what data the skill will access.
Install Mechanism
There is no install spec or external download. The package is instruction-only from an installer perspective; the only code present is pulse.js which relies on node's fs/path. No external URLs, package installs, or archive extraction were found, so install mechanism risk is low.
Credentials
The skill declares no required environment variables, no primary credential, and no restricted config paths. The code reads/writes files under the agent's working directory ('memory/*' and a temp trigger file), which is proportionate to a local stateful agent feature. No unrelated credentials are requested.
Persistence & Privilege
The skill persists state and an append-only audit/history to memory/pulse-state.json and memory/pulse-history.jsonl and checks for trigger files in the working directory. It does not request always:true and does not modify other skills' configs. Persisting to a memory directory is expected for this purpose but gives the skill ongoing local state (audit trail) that the user should know about.
What to consider before installing
This skill's README and SKILL.md promise semantic detection, configurable sensitivity, and controlled file scanning, but the provided runtime file only implements simple cooldown/deadline trigger checks and local state/log writes. Before installing: 1) Ask the author or maintainer why the runtime doesn't read openclaw.json or implement semantic analysis as documented. 2) Inspect or run pulse.js in a safe sandbox to confirm behavior (it only checks for specific trigger files and writes under ./memory). 3) If you plan to configure CONTEXT_SOURCES, confirm whether future versions will actually read those files — currently the code does not. 4) Be aware the skill will create and append to memory/pulse-history.jsonl and write memory/pulse-state.json; if you have sensitive journals or logs, control file permissions or place the skill in a restricted workspace. If you need semantic energy-detection to be real (not just documentation), request versioned proof (tests or the LLM-integration code) showing how text is analyzed and how openclaw.json config is consumed. My confidence is medium because the mismatch could be a work-in-progress (benign) or simply incomplete/shoddy packaging (suspicious); seeing the agent-side orchestration that calls this script or a future commit implementing the advertised features would clarify matters.

Like a lobster shell, security has layers — review code before you run it.

latestvk973cs4e84r2qyxhpqxvzt2t0d85ndk1
137downloads
0stars
6versions
Updated 22h ago
v0.5.0
MIT-0

Next Pulse Agent (NXT) v0.5.0

NXT transforms your agent from a reactive chat-bot into a proactive partner. It adapts its proactivity based on your inferred energy levels, ensuring it's helpful when you're peaking and supportive when you're recharging.

🌟 Key Features

  • Semantic Energy Detection: Infers energy levels (🟢 High, 🟡 Medium, 🔴 Low) from recent interactions.
  • Adaptive Proactivity: Shifts between "Deep Work", "Micro-Steps", and "Downtime Protocol".
  • Transparency Command (/pulse): Users can check the agent's current perception of their state and manually override it.
  • Context Guardrails: Automatically limits external file scanning to the most recent/relevant snippets to save tokens and prevent context overflow.
  • Smart Cooldowns: Syncs with OpenClaw's heartbeat to minimize noise.

🛠 Configuration

The agent reads these values from the skill's configuration entry in openclaw.json (skills.entries.nxt-pulse-agent.config).

  • PULSE_SENSITIVITY: Integer (1-5). 1 is conservative, 5 is highly sensitive to language cues. (Default: 3)
  • MAX_CONTEXT_CHARS: Integer. Maximum characters to read from CONTEXT_SOURCES per pulse to keep tokens low. (Default: 5000)
  • PULSE_COOLDOWN: Duration string (e.g., 30m, 4h). Minimum time between proactivity triggers.
  • DOWNTIME_KEYWORDS: Array of strings (Optional). Manual "hard-triggers" to force Recovery Mode. Note: The agent's Semantic Detection automatically identifies downtime needs in any language based on context, even without keywords.
  • CONTEXT_SOURCES: Array of strings. Relative paths to files that provide user state (e.g., journals, medical logs).
  • SCOPE: dm (default) or group. Limits proactive triggers to specific conversation types.

🚀 Commands

  • /pulse: Shows current energy level, reasoning, and upcoming tasks.
  • /pulse set [green|yellow|red]: Manually override your energy state.
  • /pulse quiet [duration]: Mutes proactive nudges for a specific time (e.g., 2h).

🚀 Workflow

1. The Pulse Audit

When triggered, the agent performs a Resource-Safe Audit:

  1. State Check: Evaluates capacity using MAX_CONTEXT_CHARS from sources.
  2. Sentiment Alignment: Adjusts based on PULSE_SENSITIVITY.
  3. Command Check: Looks for any active /pulse quiet timers.

2. Interaction Modes

  • 🟢 High Energy: Focuses on the top 1-2 priority tasks from TODOs.
  • 🟡 Medium Energy: Proposes 5-10 minute "Quick Wins".
  • 🔴 Low Energy: Triggers Downtime Protocol. No work demands. Only recovery suggestions (hydration, breaks).

Part of the OpenClaw community ecosystem. Built for performance, tuned for human limits.

Comments

Loading comments...