pulse

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:48 PM UTC
• Version: 1.0.0

Overview

The skill itself is a bounded instruction-only monitoring helper, but its recommended install command runs an unpinned remote npm CLI.

Review or pin the installer before using the `npx` command, or use the manual skill-directory installation path. After install, only create watches with clear targets, authority limits, and stop conditions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:12

Finding

Unpinned npm CLI Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 12
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

bash

npx skills add AntreasAntoniou/pulse

Technical Analysis

The installation instructions invoke the third-party skills npm CLI through npx without specifying an exact package version or integrity value. Depending on the local npm environment, npx may retrieve and execute the currently resolved release from the npm registry.

Because the CLI implementation is not included in this repository and the command does not pin a reviewed artifact, the code executed by users can differ from the code available when this skill was audited. This creates a supply-chain trust boundary in which a compromised package release, maintainer account, or registry response could result in arbitrary code execution during installation.

The repository itself contains no embedded executable payload, and this finding concerns the documented external installation process rather than malicious code confirmed inside the audited package.

Attack Path

1. An attacker compromises the npm package, its publisher account, or another part of the package distribution chain for the package resolved as skills.
2. The attacker publishes or serves a modified release containing malicious lifecycle or CLI behavior.
3. A user follows the documented unpinned npx skills add AntreasAntoniou/pulse command.
4. npx retrieves the mutable package version selected by npm resolution.
5. The package's CLI executes with the permissions of the user running the installation.
6. The malicious process can access or modify resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope may include reading user-accessible files, modifying local configuration, accessing credentials exposed to that process, in ...[truncated 280 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer CLI to an exact, reviewed version:

  bash

  npx --yes skills@<reviewed-exact-version> add AntreasAntoniou/pulse
  

• Do not use a floating tag such as latest or a semver range for security-sensitive installation documentation.

• Document the expected npm package publisher, registry, version, and package provenance so users can verify that they resolved the intended artifact.

• Publish and document a trusted integrity digest or signature verification procedure where the distribution mechanism supports it.

• Review the pinned CLI release, including lifecycle scripts and transitive dependencies, before recommending it.

• Prefer a trusted host-native skill installation mechanism that does not execute a mutable remote CLI when one is available.

• Retest and deliberately update the pinned version after reviewing future releases rather than silently inheriting them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation command uses npx skills add AntreasAntoniou/pulse without pinning a specific version or immutable reference. That allows the resolved package/tooling to change over time or be replaced through upstream compromise, causing users to install or execute unexpected code when following the README instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.