PULSE Magazine

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:51 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it says, but it can publish comments to an external site without clear confirmation guidance.

Install only if you are comfortable with the skill contacting pulse.gemdynamics.dev and with agents having a documented command that can publish comments there. Treat any comment action as requiring explicit user review and approval, and avoid sending private, secret, or unreviewed model-generated content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Dependency Permits Supply-Chain Drift

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-17
Vulnerability Type: Unpinned Python dependency
Risk Level: Medium

Vulnerable Code

yaml

"install":
  [
    {
      "id": "pip",
      "kind": "pip",
      "package": "requests",
      "label": "Install requests library",
    },
  ],

Technical Analysis

The skill declares the requests package without an exact version or an integrity hash. Consequently, installation resolves whichever release the configured Python package index considers current at installation time. The installed dependency can therefore differ from the component that was present when the skill was reviewed.

This does not establish that the legitimate requests package is currently malicious. It creates a supply-chain weakness in which a compromised package release, compromised package index, or maliciously configured index could provide attacker-controlled code. Python packages may execute code during installation, and imported package code runs when pulse_tool.py executes import requests.

Attack Path

1. An attacker compromises a future requests distribution, the package-index account or infrastructure, or an index configured in the target environment.
2. A user or automated skill installer processes the unpinned declaration and installs the attacker-controlled version.
3. Malicious package logic executes during installation or when pulse_tool.py imports requests.
4. The payload operates with the privileges and environment access of the installing or invoking process.

This attack path depends on compromise or manipulation of the dependency source; the audited project itself does not retrieve or execute a separate remote payload beyond ordinary package installation.

Impact Assessment

Successful exploitation could permit arbitrary Python code execution with the privileges of the process installing or running the skill. Depending ...[truncated 327 chars]

Remediation

View remediation

Remediation Suggestions

Pin requests to a reviewed exact version, for example requests==X.Y.Z, and update it through a controlled dependency-review process. Where the skill packaging format permits it, verify distributions with cryptographic hashes generated from trusted artifacts, such as pip's --require-hashes workflow.

Maintain a lock file containing transitive dependencies, use only trusted package indexes over TLS, and prevent untrusted environment configuration from silently replacing the intended index. Run dependency vulnerability and provenance checks in CI, review updates before deployment, and install and execute the skill under a dedicated least-privileged account or sandbox.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The public description frames the skill as a read-oriented intelligence source, but the documented behavior includes a write action that posts comments to external articles. This mismatch is dangerous because agents or users may trust the skill as informational while it can perform external state-changing actions, creating risk of unauthorized posting, spam, impersonation, or data leakage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares installation of a network-capable Python package and documents commands that clearly access remote content, but it does not declare any tool scope or permissions boundary. This weakens policy enforcement and user awareness, making it easier for an agent to perform unintended outbound network access without explicit authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documents a comment-posting command without any warning, consent requirement, or confirmation flow. In an agent setting, this can lead to accidental or autonomous publication of user-provided or model-generated content to a third-party service, causing reputational harm, spam, or disclosure of sensitive information.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill metadata describes read-only access to intelligence reports and meta-analysis, but the implementation also provides a write action that posts comments to a remote service. This mismatch can mislead users or higher-level agents into supplying content that is transmitted externally under the assumption the skill is only for reading, which increases the risk of unintended data disclosure or unauthorized actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment-posting function sends user-provided author and content fields to an external endpoint without any user-facing warning, confirmation, or disclosure at the point of use. In an agent skill context, this is dangerous because users or orchestrating agents may not realize their text is being published remotely, potentially exposing sensitive or private information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This code performs an external POST request carrying user-supplied data to a third-party service. External transmission is not inherently malicious, but in this context it is security-relevant because the operation publishes supplied content and identity data off-system, creating confidentiality and integrity risks if invoked without clear authorization or awareness.

Content

Scanner excerpt · pulse_tool.py (reported line 24)May include surrounding context.

python

def post_comment(slug, author, content):
    payload = {"author": author, "content": content}
    response = requests.post(f"{BASE_URL}/api/v1/articles/{slug}/comments", json=payload)
    if response.status_code == 200:
        print(json.dumps(response.json(), indent=2))
    else:

Static analysis

No suspicious patterns detected.