NXT Pulse Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 0.5.0

Overview

This appears to be a legitimate proactive energy/task assistant, but it needs Review because it can analyze sensitive local files and recent messages without enough scoping or privacy disclosure.

Install only if you are comfortable with the agent inferring energy state from recent conversations and any files you configure. Keep CONTEXT_SOURCES limited to a dedicated, non-sensitive directory; do not point it at credentials, full journals, medical records, or broad logs unless you explicitly want that data used. Review or clear memory/pulse-state.json and memory/pulse-history.jsonl if local pulse history should not persist.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:21
• Finding: Unrestricted Sensitive Context-File Access Through CONTEXT_SOURCES<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:21-28` **Vulnerability Type**: Unrestricted local file access and path traversal **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown The agent reads these values from the skill's configuration entry in `openclaw.json` (`skills.entries.nxt-pulse-agent.config`). - `PULSE_SENSITIVITY`: Integer (1-5). 1 is conservative, 5 is highly sensitive to language cues. (Default: `3`) - `MAX_CONTEXT_CHARS`: Integer. Maximum characters to read from `CONTEXT_SOURCES` per pulse to keep tokens low. (Default: `5000`) - `PULSE_COOLDOWN`: Duration string (e.g., `30m`, `4h`). Minimum time between proactivity triggers. - `DOWNTIME_KEYWORDS`: Array of strings (Optional). Manual "hard-triggers" to force Recovery Mode. Note: The agent's **Semantic Detection** automatically identifies downtime needs in any language based on context, even without keywords. - `CONTEXT_SOURCES`: Array of strings. Relative paths to files that provide user state (e.g., journals, medical logs). - `SCOPE`: `dm` (default) or `group`. Limits proactive triggers to specific conversation types. ``` Related workflow instruction at `SKILL.md:38-41`: ```markdown ### 1. The Pulse Audit When triggered, the agent performs a **Resource-Safe Audit**: 1. **State Check**: Evaluates capacity using `MAX_CONTEXT_CHARS` from sources. 2. **Sentiment Alignment**: Adjusts based on `PULSE_SENSITIVITY`. ``` ### Technical Analysis The skill directs the agent to read files supplied through `CONTEXT_SOURCES`, including explicitly sensitive categories such as journals and medical logs. It does not define an approved root directory, canonical-path validation, traversal rejection, symbolic-link handling, file-type restrictions, or source-specific user consent. Restricting reads to relative paths is not a sufficient access-control boundary. A relative value such as `../../.ssh/id_rsa` can resolve outside the intended project or memory directory. Similarly, a p ...[truncated 2039 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict context sources to a dedicated, explicitly approved directory. 2. Resolve each configured path with a canonicalization function before reading it. 3. Verify that the canonical path remains beneath the approved root directory using a separator-aware containment check. 4. Reject absolute paths, traversal components, device paths, and paths that escape through symbolic links. 5. Apply an allowlist of expected file extensions and reject special files, sockets, devices, and directories. 6. Require explicit user approval before adding each context source, especially journals, medical records, credential stores, and logs. 7. Run the skill under a least-privileged operating-system account that cannot access unrelated secrets. 8. Scan and redact likely credentials, tokens, private keys, and other secrets before placing file content into model context. 9. Treat `MAX_CONTEXT_CHARS` only as a resource limit, not as a security control. 10. Document whether context is sent to an external model provider and provide an opt-out for sensitive sources. 11. Add tests covering `../` traversal, absolute paths, symbolic-link escapes, encoded traversal variants, and paths sharing only a textual prefix with the approved root. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill description presents a benign energy/task assistant, but the finding indicates additional undeclared behaviors such as persistent file access, trigger-file deadline detection, scheduling logic, and audit logging. Hidden or undocumented capabilities materially increase risk because users and host systems cannot make informed consent or permission decisions, especially when the documented config includes sensitive context sources like journals or medical logs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly states the skill monitors user state and energy levels and later describes reading recent messages to infer a user's 'vibe,' but it does not clearly warn users about the privacy implications of ongoing message analysis. For a proactive agent skill, silent behavioral monitoring can expose sensitive personal context and create consent issues, especially if users do not realize their conversations are being continuously interpreted.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The configuration example allows reading arbitrary external files via CONTEXT_SOURCES such as memory and log files, but the README does not clearly warn that the skill will access those files during pulse checks. This can lead users to expose sensitive local notes or logs without understanding the scope of access, particularly because the feature is framed as convenience rather than data access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly encourages use of sensitive context sources such as journals and medical logs, but it does not warn users about privacy, retention, logging, or disclosure risks. In a proactive agent that infers mental/physical state, silent ingestion of highly sensitive personal data can lead to overcollection, unintended exposure, or secondary use beyond user expectations.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The description presents the skill as broadly proactive in managing user energy and task prioritization, but it does not define clear triggers, scope boundaries, or limits on autonomous behavior. In an agent ecosystem, vague activation criteria can cause overreach into unrelated workflows or sensitive user context, increasing the chance of unintended actions or manipulative nudging.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The comment explicitly delegates urgency detection to the main LLM agent based on natural-language context, which can cause untrusted user input to influence behavioral overrides. In this skill, that can bypass the normal cooldown logic and trigger repeated or unnecessary proactive nudges, creating a prompt-injection or manipulation surface even though the actual file check is local.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The README states that semantic detection works in any language by default, which implies broad analysis of user content without an explicit opt-in or narrowing of scope. While not inherently malicious, default language-agnostic detection increases the chance that sensitive content is interpreted unexpectedly across multilingual conversations, reducing informed consent and predictability.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The documentation states that semantic detection identifies downtime needs "in any language based on context," which implies language handling behavior without an explicit user opt-in or language/locale choice. This can conflict with language or locale policy expectations when a skill silently applies multilingual inference by default.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The metadata sets the skill language to 'en', which indicates a fixed language choice. There is no accompanying note that this is optional, user-selectable, or justified by a region-specific requirement, so it may violate language or locale choice policy.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: This code appends audit data to `memory/pulse-history.jsonl`, which persists runtime decisions and pulse metadata, but the operation is only described in an internal comment and not disclosed to the user. Under the code-file criteria, file writes that affect user data or local state should have some visible confirmation, prompt, or other user-facing disclosure unless clearly covered by the skill description.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The script writes `pulse-state.json` to disk to track pulse timing and mode, but there is no confirmation prompt or user-facing notice that persistent state is being created or updated. Internal comments about state management do not satisfy the requirement for visible disclosure in code files.

Static analysis

No suspicious patterns detected.