PulseFeed — verify before you pay or install

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

The skill is a Markdown-only guide for checking x402 endpoints and npm/MCP packages, with a disclosed supply-chain caution around optional unpinned npm commands.

Use the skill as a checking guide, but pin and verify any optional npm packages before running `npx` or `npm i`. Be aware that endpoint URLs or package names are sent to pulsefeed.dev, and the live deep check is paid via x402 even though the basic checks are free.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:61

Finding

Unpinned Third-Party npm Package Execution and Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–62
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- MCP server (same checks as tools): `npx -y pulsefeed-x402-mcp`
- Guard SDK (blocks bad payments automatically): `npm i pulsefeed-x402-guard`

Technical Analysis

The documented commands resolve packages through the npm registry without specifying exact, previously reviewed versions. The npx -y command is particularly sensitive because it automatically accepts package installation and then executes the resolved package. Neither command specifies a version, verified integrity digest, lockfile, trusted provenance requirement, or mandatory source-review procedure.

Consequently, the code executed or installed when a user follows this guidance can differ from the artifact that existed when the Skill was audited. If a package maintainer account or publishing token is compromised, a package is transferred to a malicious maintainer, or a malicious release becomes the registry's default version, the commands could retrieve and run attacker-controlled code.

This finding does not establish that either named package is currently malicious. The vulnerability is the unsafe, unpinned dependency acquisition and automatic execution pattern recommended by the Skill.

Attack Path

1. An attacker compromises the npm maintainer account, publishing credentials, or supply chain of pulsefeed-x402-mcp or pulsefeed-x402-guard.
2. The attacker publishes a malicious version that becomes the version resolved by the unpinned package name.
3. A user follows the command in SKILL.md.
4. For npx -y pulsefeed-x402-mcp, npm downloads the currently resolved package without an interactive confirmation and executes its entry point. Package lifecycle scripts may also run during acquisition.
5. For npm i pulsefeed-x402-guard, npm installs the currently resolv ...[truncated 943 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unversioned package references with exact, reviewed versions, such as package-name@x.y.z. Do not use version ranges or floating distribution tags for security-sensitive tooling.
2. Avoid recommending automatic execution through npx -y. Require users to inspect package metadata, provenance, repository contents, and lifecycle scripts before executing the package.
3. Provide the canonical source repository and identify the reviewed source commit corresponding to each recommended npm release.
4. Publish and document expected integrity hashes or signed provenance information, and instruct users to verify them before installation.
5. Use a committed lockfile for project installations and perform reproducible installation with npm ci.
6. Where supported, require npm provenance attestations and monitor the packages for maintainer, ownership, lifecycle-script, and release-signing changes.
7. Recommend testing unfamiliar packages in an isolated, least-privileged environment without production credentials, wallet keys, or access to sensitive host files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill recommends running npx -y pulsefeed-x402-mcp without pinning a specific version, which causes users to fetch and execute whatever the latest package version is at runtime. If the npm package is later compromised, hijacked, or updated with malicious code, users of the skill would execute attacker-controlled code immediately on their machine.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.