Security audit

NXT Pulse Agent

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate proactive energy/task assistant, but it needs Review because it can analyze sensitive local files and recent messages without enough scoping or privacy disclosure.

Install only if you are comfortable with the agent inferring energy state from recent conversations and any files you configure. Keep CONTEXT_SOURCES limited to a dedicated, non-sensitive directory; do not point it at credentials, full journals, medical records, or broad logs unless you explicitly want that data used. Review or clear memory/pulse-state.json and memory/pulse-history.jsonl if local pulse history should not persist.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:21
Finding: Unrestricted Sensitive Context-File Access Through CONTEXT_SOURCES
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill description presents a benign energy/task assistant, but the finding indicates additional undeclared behaviors such as persistent file access, trigger-file deadline detection, scheduling logic, and audit logging. Hidden or undocumented capabilities materially increase risk because users and host systems cannot make informed consent or permission decisions, especially when the documented config includes sensitive context sources like journals or medical logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly states the skill monitors user state and energy levels and later describes reading recent messages to infer a user's 'vibe,' but it does not clearly warn users about the privacy implications of ongoing message analysis. For a proactive agent skill, silent behavioral monitoring can expose sensitive personal context and create consent issues, especially if users do not realize their conversations are being continuously interpreted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The configuration example allows reading arbitrary external files via CONTEXT_SOURCES such as memory and log files, but the README does not clearly warn that the skill will access those files during pulse checks. This can lead users to expose sensitive local notes or logs without understanding the scope of access, particularly because the feature is framed as convenience rather than data access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly encourages use of sensitive context sources such as journals and medical logs, but it does not warn users about privacy, retention, logging, or disclosure risks. In a proactive agent that infers mental/physical state, silent ingestion of highly sensitive personal data can lead to overcollection, unintended exposure, or secondary use beyond user expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The description presents the skill as broadly proactive in managing user energy and task prioritization, but it does not define clear triggers, scope boundaries, or limits on autonomous behavior. In an agent ecosystem, vague activation criteria can cause overreach into unrelated workflows or sensitive user context, increasing the chance of unintended actions or manipulative nudging.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The comment explicitly delegates urgency detection to the main LLM agent based on natural-language context, which can cause untrusted user input to influence behavioral overrides. In this skill, that can bypass the normal cooldown logic and trigger repeated or unnecessary proactive nudges, creating a prompt-injection or manipulation surface even though the actual file check is local.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README states that semantic detection works in any language by default, which implies broad analysis of user content without an explicit opt-in or narrowing of scope. While not inherently malicious, default language-agnostic detection increases the chance that sensitive content is interpreted unexpectedly across multilingual conversations, reducing informed consent and predictability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The documentation states that semantic detection identifies downtime needs "in any language based on context," which implies language handling behavior without an explicit user opt-in or language/locale choice. This can conflict with language or locale policy expectations when a skill silently applies multilingual inference by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The metadata sets the skill language to 'en', which indicates a fixed language choice. There is no accompanying note that this is optional, user-selectable, or justified by a region-specific requirement, so it may violate language or locale choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code appends audit data to memory/pulse-history.jsonl, which persists runtime decisions and pulse metadata, but the operation is only described in an internal comment and not disclosed to the user. Under the code-file criteria, file writes that affect user data or local state should have some visible confirmation, prompt, or other user-facing disclosure unless clearly covered by the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes pulse-state.json to disk to track pulse timing and mode, but there is no confirmation prompt or user-facing notice that persistent state is being created or updated. Internal comments about state management do not satisfy the requirement for visible disclosure in code files.
Content: No source excerpt is available for this finding.