NXT Pulse Agent

• Risk level: Low
• Analyzed: Apr 29, 2026, 11:33 AM
• Findings: 0
• Version: 0.5.0

Overview

The skill's code, instructions, and requested resources are consistent with a local, proactive 'energy management' agent — it reads/writes local project files for context and state but does not request secrets or reach out to external endpoints.

This skill appears coherent with its stated purpose and does not request credentials or perform network calls. Before installing: (1) Review and restrict the config value CONTEXT_SOURCES to only the specific non-sensitive files you want the agent to read (avoid pointing it at full home directories, system logs, or medical records unless you intend that). (2) Be aware it will create/write memory/pulse-state.json and memory/pulse-history.jsonl in the agent working directory — inspect and rotate or protect those files if they contain sensitive notes. (3) Note the code looks for trigger files (temp_deadline_trigger.txt, memory/critical_deadlines.txt, memory/deadlines/YYYY-MM-DD.txt) that can force a CRITICAL override — ensure other skills or scripts can't create those files unintentionally. (4) If you plan to allow autonomous invocation, monitor initial runs and review logs to confirm behavior matches expectations. If you want higher assurance, review the repository linked in package.json or run the pulse.js in a sandbox first.