Arc Fulcra Sleep Detective

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.6

Overview

The skill is mostly a retired, privacy-conscious routing document, but its setup instructions tell users to run an unpinned external CLI during authentication, which deserves review before installation.

Review the Fulcra CLI provenance before following the setup commands. Prefer a pinned, reviewed `fulcra-api` version from a trusted registry and avoid starting the authentication flow until the executable source and version are verified. The skill text itself is privacy-bounded and does not ship code, but the unpinned CLI setup is the main risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-41 and README.md:32-34
Vulnerability Type: Unpinned dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:39-41:

bash

uv tool run fulcra-api --help
uv tool run fulcra-api auth login --get-auth-url
uv tool run fulcra-api user-info

The same commands are duplicated in README.md:32-34:

bash

uv tool run fulcra-api --help
uv tool run fulcra-api auth login --get-auth-url
uv tool run fulcra-api user-info

Technical Analysis

The documented setup commands instruct users to resolve and execute the fulcra-api package without specifying an audited version, an artifact hash, or a verified package source. The repository also provides no lockfile or vendored artifact that constrains which package release will be executed.

uv tool run can acquire the package from the configured package index and then invoke its executable. Consequently, the code executed by these instructions can change after this skill has been reviewed. A compromised publisher account, package-index compromise, malicious configured index, or compromised future release could cause arbitrary package code to run locally.

Merely invoking --help does not provide a security boundary: package installation, module initialization, and command entry-point loading may execute package-controlled code before help output is displayed.

Attack Path

1. An attacker compromises the package publisher, distribution channel, configured package index, or a future release of fulcra-api.
2. The attacker publishes a malicious package version under the name that the unpinned command resolves.
3. A user follows the setup instructions and executes uv tool run fulcra-api --help or one of the subsequent authentication commands.
4. uv resolves and installs the attacker-controlled release because no version or artifact integrity constraint is specified.
5. The ma ...[truncated 1066 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin fulcra-api to a specific version that has undergone security review, for example:

   bash

   uv tool run 'fulcra-api==X.Y.Z' --help
   

2. Identify and enforce the trusted package registry rather than relying on ambient package-index configuration.

3. Verify the downloaded artifact with a cryptographic hash or signature before execution. Where practical, distribute a reviewed wheel and install it from a controlled source with hash verification.

4. Maintain a lockfile or equivalent immutable dependency manifest covering fulcra-api and its transitive dependencies.

5. Test and review the exact pinned artifact before publishing setup instructions.

6. Run initial package verification in a restricted environment with minimal filesystem, credential, and network access.

7. Do not perform authentication until package provenance and integrity have been verified.

8. Apply the same corrected instructions to both SKILL.md and README.md to prevent users from following the unsafe duplicate.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

https://mcp.fulcradynamics.com/mcp

text

Never print, paste, log, or share access tokens, refresh tokens, credential files, raw private records, or direct capability URLs.

## License

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

https://mcp.fulcradynamics.com/mcp

text

Never print, paste, log, or share access tokens, refresh tokens, credential files, raw private records, or direct capability URLs.

## License

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill instructs operators to run uv tool run fulcra-api without pinning an exact package version. That creates a supply-chain and reproducibility risk: a later upstream release could change behavior or introduce malicious code, and users following the skill would automatically execute it. The retirement/privacy framing makes the intent benign, but the unpinned executable reference is still a real operational security issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

This command uses uv tool run fulcra-api without a fixed version when performing authentication flow setup. If the package is updated or compromised upstream, users could be directed through a malicious auth process or run altered code while trying to log in. Because this is an auth-related invocation, the surrounding context makes the supply-chain risk somewhat more sensitive than a generic help command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The user-info example also invokes an unpinned external tool, exposing users to execution of whatever version is current at resolution time. In a skill handling sensitive personal data, even a benign-looking metadata read can become a vector for compromised code or unexpected data access if the dependency supply chain is not controlled.

Content

No source excerpt is available for this finding.