Security audit

Agent Pulse (Deprecated)

Security checks for vulnerabilities and agentic risk

Overview

This deprecated skill contains conflicting active wallet instructions and dormant scripts for private keys, external APIs, token approvals, and scheduled pulsing, so it needs careful review before any use.

Treat this as a Review item, not a safe active wallet skill. Do not export a funded PRIVATE_KEY or run these scripts for live wallet activity from this package; use the maintained replacement instead. If a private key was ever used with these scripts or sent to the pulse API, rotate that wallet and revoke outstanding approvals.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/pulse.sh:75
Finding: Wallet Private Key Transmitted to an External API
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup.ts:1
Finding: Unpinned Package Execution Through npx Shebang
Content: View full analysis
--tier free --json ``` ### Technical Analysis The shebang invokes `npx tsx` before JavaScript execution reaches the deprecation guard. If an approved local `tsx` binary is unavailable, `npx` can resolve and download executable package content from the configured npm registry. The command does not identify an exact reviewed version or integrity value. Consequently, the line-3 `process.exit(1)` does not prevent package-resolution risk: the TypeScript runtime must already have been resolved and started before that guard can execute. The migration instructions similarly call `npm install` and then `npx tsx` without demonstrating lockfile-based, integrity-verified installation. npm lifecycle scripts and executable package entry points run with the invoking user's privileges. ### Attack Path 1. A user directly invokes `scripts/setup.ts` based on its executable shebang, or follows the documented replacement installation instructions. 2. No trusted local `tsx` installation is available, or dependency resolution uses a compromised registry or package version. 3. `npx` retrieves and launches mutable third-party package code, or `npm install` executes a malicious lifecycle script. 4. The dependency code runs before the deprecated setup script can terminate. 5. The malicious package inherits the user's environment and filesystem permissions and may access credentials such as `PRIVATE_KEY` if exported. ...[truncated 657 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description presents the skill purely as deprecated/archived metadata with no permissions or active behavior. The supplied code contains substantial operational logic for wallet monitoring and automated pulsing, which is materially different and undeclared. Although the current script exits immediately with a deprecation message—so the monitoring/pulsing logic is unreachable at runtime in this exact chunk—the actual code body still implements sensitive capabilities involving private key handling, external API access, and transaction-like pulse actions. That is a meaningful description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose suggests the skill is only an archived/deprecated placeholder with no active behavior or permissions. However, the code contains network-capable logic to contact an external API endpoint and retrieve configuration data. Although the current control flow exits before that code runs, the shipped code chunk still embeds an undeclared capability and an active purpose beyond a simple deprecation stub. That makes the description materially incomplete relative to the implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a mismatch because the declared description says the skill is deprecated and effectively replaced, implying no active operational behavior. However, the supplied code chunk includes substantial live monitoring functionality: command-line parsing, file input, address validation, external network access to status/feed endpoints, and JSON/plaintext output. Although the first executable line currently prints a deprecation notice and exits, the actual code chunk still embodies capabilities not represented by the declaration, especially since the declaration lists no permissions while the code is designed to perform network access and local file reads. The primary purpose described as 'deprecated archive' does not accurately represent the implemented behavior of a multi-agent monitor.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a mismatch because the declared description says the skill is deprecated and archived, implying it should not provide operational functionality. The code chunk, despite an immediate early exit at the top, contains substantial implemented behavior for wallet-linked pulse submission via HTTP and direct on-chain contract interaction. Those capabilities are not reflected in the declared purpose or empty permissions. Even if the current top-level execution path exits immediately, the supplied code actually embodies materially broader functionality involving external network access, blockchain transactions, and private-key use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a mismatch because the declared description says the skill is deprecated and archived, implying it should not perform active operational behavior. While the first lines do immediately terminate with a deprecation message, the supplied code chunk clearly contains substantial active setup behavior: it checks for a PRIVATE_KEY, runs shell scripts, creates an openclaw cron job, and verifies scheduled registration. Those are materially different capabilities from a purely deprecated placeholder, and they introduce undeclared resource access and recurring execution behavior. Even if some of the logic is currently unreachable due to the early process exit, the code chunk as supplied includes active wallet-monitoring setup functionality not represented by the description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is presented as deprecated and archived, yet it contains live logic to sign transactions, approve token spending, and send authenticated API requests using a private key. This mismatch is dangerous because users or automation may trust the deprecated label and underestimate that the file still performs wallet-affecting operations if the early exit is removed, bypassed, or copied from the script.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 93% confidence
Finding: The script recommends a classic curl-pipe-to-bash installation pattern for Foundry, which executes remote code fetched over the network without integrity verification or pinning. In a wallet-related setup flow where users are expected to export a PRIVATE_KEY, normalizing this pattern increases the chance of supply-chain compromise and subsequent key theft or malicious transaction signing if the remote endpoint or installation path is ever compromised.
Content: Scanner excerpt · scripts/setup.sh (reported line 58)May include surrounding context.
sh
if ! command -v cast &>/dev/null; then RESULT_ERRORS+=("cast not found") fail "'cast' (Foundry) not installed. Install: curl -L https://foundry.paradigm.xyz | bash" $QUIET && echo '{"ok":false,"error":"cast not found"}' exit 1 fi

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README materially conflicts with the published skill metadata by presenting this as an active wallet-enabled x402janus skill rather than a deprecated archived Pulse skill. That mismatch can mislead operators into exporting a private key and running transaction-capable scripts under false assumptions about what the skill is, increasing the chance of unsafe execution and secret exposure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation encourages active wallet configuration, allowance approval, and on-chain transaction execution despite the skill metadata describing it as deprecated/archived. This creates a social-engineering style risk where users may trust stale or mislabeled content and perform sensitive actions with a private key in an artifact they would otherwise avoid.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The explicit --auto-approve flag in the quick-start path normalizes autonomous approval during initial setup, which can lead users to authorize token spending without scrutinizing the transaction. In a wallet-integrated skill, this is more dangerous because the same instructions ask the user to export a private key and immediately run scripts capable of on-chain writes.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
bash
# 1. Configure export PRIVATE_KEY="0x..." ./scripts/setup.sh --auto-approve # 2. Send a pulse ./scripts/pulse.sh --direct 1000000000000000000

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 79% confidence
Finding: The explicit --auto-approve flag in the quick-start path normalizes autonomous approval during initial setup, which can lead users to authorize token spending without scrutinizing the transaction. In a wallet-integrated skill, this is more dangerous because the same instructions ask the user to export a private key and immediately run scripts capable of on-chain writes.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
bash
# 1. Configure export PRIVATE_KEY="0x..." ./scripts/setup.sh --auto-approve # 2. Send a pulse ./scripts/pulse.sh --direct 1000000000000000000

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The migration example uses npx tsx without pinning a version, which can fetch whatever package version is current at execution time. That creates a supply-chain risk: a compromised or breaking upstream release could execute unreviewed code on the user's system when they follow the documented command.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill metadata says the skill is deprecated and archived, but the file provides active, actionable instructions for interacting with a live Pulse API. This mismatch can mislead users or downstream agents into invoking outdated or unintended wallet-related operations, especially in an environment where automated tools may trust metadata for safety or routing decisions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs users to send a pulse by burning 1 PULSE to a dead address, but it does not prominently warn that this action is irreversible and consumes funds. In an agent setting, this omission increases the chance of accidental value loss because operators may treat the action as a harmless liveness ping rather than a spend operation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The example performs an authenticated POST to an external service and includes a payment proof header, which transmits wallet/payment-related material off-host. While this is expected for the protocol, it is still security-relevant because agents could exfiltrate sensitive payment headers or trigger unintended paid actions against a third-party endpoint if the example is executed without safeguards.
Content: Scanner excerpt · references/action_guide.md (reported line 47)May include surrounding context.
bash
export X402_PAYMENT_HEADER='...' curl -sS -f -X POST "https://x402pulse.xyz/api/pulse" \ -H "Content-Type: application/json" \ -H "X-402-Payment: $X402_PAYMENT_HEADER" \ -d '{"agentAddress":"0xAgent","amount":"1000000000000000000"}'

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The immediate deprecation message and exit contradict the rest of the file, which documents and implements auto-pulse behavior using a private key and downstream transaction execution. This kind of dead-but-dangerous code is risky because it obscures the file’s true capabilities during review, increases the chance of accidental reactivation, and can hide sensitive operational logic in an apparently inert archived artifact.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest and top-level behavior present this skill as deprecated, yet the script still contains fully implemented wallet-monitoring and transaction-triggering logic. Even though the current second line exits immediately, shipping active private-key and transaction code inside an archived skill creates a dangerous mismatch: maintainers or users may remove the guard, copy portions of the script, or rely on stale assumptions about its safety and operational status.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Line L02 unconditionally prints a deprecation message and exits, making all later logic unreachable. This directly contradicts the file header and usage comments in L04-L05 that claim the script checks x402janus subscription status for a wallet.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The script transmits a wallet address, alert-channel identifiers, and optionally an authentication session token to a remote server via curl. Because API_BASE is overrideable from the environment and the endpoint is an external domain, a user could unintentionally send sensitive data or a live session cookie to an untrusted host if the environment is manipulated. The deprecation banner and immediate exit reduce runtime exposure in the current form, but the underlying code remains unsafe if re-enabled or copied.
Content: Scanner excerpt · scripts/guardian-subscribe.sh (reported line 87)May include surrounding context.
sh
EXTRA_HEADER=(-H "Cookie: guardian_session=$SESSION_TOKEN") fi RESPONSE=$(curl -s -w "\n__STATUS__%{http_code}" \ -X POST "$API_BASE/api/guardian/subscribe" \ -H "Content-Type: application/json" \ "${EXTRA_HEADER[@]}" \

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Line L02 states the skill is no longer maintained and exits, which conveys that the script only reports deprecation and stops. However, lines L06-L12 still contain active logic to call a remote protocol-health endpoint, contradicting the apparent documented intent of the file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script unconditionally prints a deprecation message and exits before any of the documented monitoring logic can run, while still shipping substantial hidden network-capable code below. This discrepancy is dangerous because it can mislead reviewers and operators about the file's real contents, conceal undeclared behavior from casual inspection, and create a maintenance blind spot where dormant but active-capable logic remains in the repository.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is labeled as archived/deprecated, but the file contains full remote monitoring functionality that queries an external API and processes its responses. In a security-sensitive agent ecosystem, mismatches between declared intent and actual network behavior are risky because users may trust or whitelist the skill as inert while it still contains live outbound capabilities and logic that can be re-enabled by a small change.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script immediately claims the skill is no longer maintained, while the remainder of the file contains intact operational logic for direct on-chain execution and API-based pulse submission. Even though the current early exit prevents execution, embedding active wallet logic behind a deprecation banner creates a misleading trust boundary and increases the chance that maintainers or users will reuse unsafe code without proper review.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The script sends an HTTP POST to an external service and, when PRIVATE_KEY is set, includes that private key directly in the X-PRIVATE-KEY header. Transmitting a wallet private key to a remote endpoint is highly sensitive and can lead to immediate compromise of funds, signatures, and account control if the endpoint, transport, logs, or intermediaries are untrusted or breached.
Content: Scanner excerpt · scripts/pulse.sh (reported line 79)May include surrounding context.
sh
EXTRA_ARGS+=(-H "X-PRIVATE-KEY: $PRIVATE_KEY") fi RESPONSE=$(curl -s -w "\n__STATUS__%{http_code}" -X POST "$API_BASE/api/pulse" \ -H "Content-Type: application/json" \ "${EXTRA_ARGS[@]}" \ -d "{}")