Pulsebot App Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:14 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for Timeplus dashboard building, but generated apps automatically connect to a local data proxy and execute mutable CDN JavaScript without integrity checks.

Review this before installing if your Proton data is sensitive. Generated apps may query localhost:8001 as soon as the HTML opens and will run JavaScript fetched from unpkg; prefer pinned dependencies with SRI or vendored assets, and require a visible manual Connect/Run action showing the SQL before execution.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:52

Finding

Mutable Third-Party JavaScript Is Retrieved and Executed Without Integrity Verification

Content

View full analysis

``` The reference files repeat the same unsafe dependency-loading pattern, including: ```html ``` ```html ...[truncated 3425 chars]

Remediation

View remediation

``` 3. Prefer vendoring reviewed dependency artifacts with the application so that opening it does not retrieve mutable executable code. 4. If remote hosting is required, serve approved artifacts from a controlled, immutable location and monitor them for unauthorized changes. 5. Add a restrictive Content Security Policy that permits scripts only from approved sources and limits outbound connections to required endpoints. 6. Restrict `connect-src` to the Proton proxy and explicitly approved services. Avoid broad wildcards. 7. Review dependency provenance, release signatures, vulnerability advisories, and transitive dependencies before updating pinned versions. 8. Update `SKILL.md`, `references/PROTON_DRIVER.md`, and `references/VISTRAL_API.md` consistently so generated applications cannot reintroduce the unsafe pattern from a reference example. 9. Ensure the Proton proxy requires appropriate authentication and authorization and enforces restrictive CORS behavior to reduce the impact of compromised browser code. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation guidance is broad enough to trigger on generic app-building requests, which can cause the skill to be invoked outside its intended Timeplus/Pulsebot scope. In that case, the agent may generate HTML that assumes local proxy access, external CDN dependencies, and auto-running data queries in contexts where the user did not intend networked database access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly directs generated frontend code to connect from the user's browser to a service on localhost:8001, but does not require a clear warning or confirmation that opening the HTML will initiate local network access. This is dangerous because localhost services are privileged trust boundaries; a user may open the app expecting a static visualization, while it immediately probes and exchanges data with a local database proxy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The delivery instructions tell the agent to create and present an app that opens directly in a browser, while the provided template auto-runs runQuery() on page load. Without an explicit warning, users may unknowingly execute live queries immediately upon opening the file, causing unintended access to local services and potentially exposing sensitive streaming data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/PROTON_DRIVER.md (reported line 157)May include surrounding context.

javascript

const { ndjsonStreamParser } = window.ProtonDriver;

const response = await fetch('http://localhost:8001/query', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ query: sql }),

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · references/PROTON_DRIVER.md (reported line 157)May include surrounding context.

javascript

const { ndjsonStreamParser } = window.ProtonDriver;

const response = await fetch('http://localhost:8001/query', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ query: sql }),

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction 'All Timeplus apps use a dark theme. Never ship a light-mode app without an explicit request' imposes a specific visual mode by default. This is a natural-language policy concern because it forces a locale-like presentation choice without indicating user choice or broader accessibility justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The provided HTML template hard-codes <html lang="en">, which imposes an English locale in the generated app. The skill does not mention user opt-in, localization options, or a documented reason that English-only output is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The directive 'Always pass theme="dark" to Vistral components' hard-codes a presentation setting rather than offering user selection. This may violate policy expectations around user choice unless the dark-only requirement is clearly justified as product-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The line states to "always use 'dark' for Timeplus apps," which imposes a presentation preference as a universal requirement rather than offering a user choice. This is a natural-language policy concern because it forces a specific display mode without opt-in or accessibility consideration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This line says to "Always use theme="dark" for Timeplus-branded applications," which is a blanket requirement for a specific visual mode. Forcing a display/theme choice in natural-language guidance can violate organizational policy when no user choice or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.