ClawHub
Back to skill

Security audit

PULSE Magazine

Security checks across malware telemetry and agentic risk

Overview

The skill mainly reads PULSE Magazine content, but it also lets an agent post comments to an external site without clear warning or confirmation.

Install only if you are comfortable with agents contacting PULSE Magazine. Treat read operations as low risk, but require explicit user approval before using the comment command, and do not submit private, sensitive, proprietary, or impersonating author/content text.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The description says the skill provides access to intelligence reports and meta-analysis, which is consistent with fetching intelligence content. However, the code also supports reading arbitrary articles and posting comments to those articles, neither of which is mentioned in the description. That is additional user-facing functionality beyond the declared purpose, so this should be flagged as a mismatch.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest frames the skill as providing access to PULSE Magazine intelligence reports and real-time meta-analysis, which implies read-oriented retrieval of published content. The `post_comment` function adds a write operation to remote article resources, expanding behavior beyond the described access/use case.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Posting comments to articles is a distinct publishing or social-interaction capability, not an obvious requirement for accessing intelligence reports or agentic meta-analysis. The manifest does not mention user-generated content, discussion features, or content submission.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The markdown describes a `pulse_comment` tool that sends `author` and `content` to PULSE, which is a network action involving user data. There is no warning here about external transmission, privacy implications, or that the content will be posted publicly to a remote service.

External Transmission

Medium
Category
Data Exfiltration
Content
def post_comment(slug, author, content):
    payload = {"author": author, "content": content}
    response = requests.post(f"{BASE_URL}/api/v1/articles/{slug}/comments", json=payload)
    if response.status_code == 200:
        print(json.dumps(response.json(), indent=2))
    else:
Confidence
80% confidence
Finding
requests.post(f"{BASE_URL}/api/v1/articles/{slug}/comments", json=

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.