PulseNetwork Paid Data

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:03 AM UTC
• Version: 1.0.0

Overview

The skill is transparent about paid data calls and user consent, but its recommended unpinned MCP package handles wallet funds and private-key material.

Review before installing. Use a pinned and reviewed @pulsenetwork/mcp version where possible, run it with least privilege, use a dedicated low-balance wallet, avoid supplying a general-purpose private key, keep spending caps low, and require explicit confirmation for paid calls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:56

Finding

Unpinned Third-Party MCP Package Handles Wallet Secrets and Funds

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56-62
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

text

- **MCP (recommended for OpenClaw)**: add the npm package `@pulsenetwork/mcp` as an MCP
  server. `pulse_discover` searches all endpoints free; `pulse_call` pays under hard local
  spend caps (defaults $0.50 per call, $5 per day; tune with `PULSEPAY_MAX_PER_CALL` and
  `PULSEPAY_MAX_PER_DAY`). Funding: on first run the server generates its own local wallet
  (kept at `~/.pulsepay/wallet.json`; back it up) and prints the address; send it a few
  dollars of USDC on Base. To use your own key instead, set the `PULSEPAY_EVM_KEY`
  environment secret in the MCP server config. Keys never go in chat.

Technical Analysis

The Skill recommends installing and executing @pulsenetwork/mcp without specifying an immutable package version, integrity hash, lockfile, or source-verification procedure. Package resolution may therefore select whichever release is current at installation time, meaning the executed implementation can differ from the dependency that was originally reviewed.

This dependency is security-sensitive because it operates as an MCP server, generates and stores a funded wallet, performs paid calls, and may receive an EVM private key through PULSEPAY_EVM_KEY. If the package registry account, publication pipeline, maintainer environment, or a future release is compromised, malicious package code would execute in the MCP server's local security context and could access secrets and wallet material available to that process.

This finding identifies an unsafe supply-chain configuration rather than evidence that the named package is currently malicious.

Attack Path

1. An attacker compromises the package's publication channel or causes a malicious release to become the version selected by an unpinned installation.
2. An agent or use ...[truncated 1221 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @pulsenetwork/mcp to a specifically audited version rather than allowing mutable latest-version resolution.
2. Record and verify package integrity through a lockfile and registry integrity metadata; where practical, additionally verify signed release provenance.
3. Document the authoritative package repository and compare published artifacts with reviewed source code before deployment.
4. Run the MCP server in an isolated, least-privilege environment with restricted filesystem access, a minimal environment, and outbound network access limited to required destinations.
5. Use a dedicated, low-balance wallet exclusively for this integration. Do not supply a general-purpose or high-value EVM key.
6. Retain strict per-call and daily spending caps, and enforce transaction-level destination, asset, network, and amount allowlists outside the dependency where possible.
7. Restrict permissions on ~/.pulsepay/wallet.json, avoid unnecessary backups containing plaintext wallet material, and ensure backups are encrypted and access-controlled.
8. Review dependency updates before changing the pinned version, including transitive dependencies, install scripts, release provenance, and relevant security advisories.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

1. **Never pay without telling the user.** Before the first paid call in a task, state the
   endpoint and the exact price from its catalog entry or 402 challenge, and get the user's
   go-ahead. For a batch the user approved, state the total budget up front.
2. **Never ask the user to paste a private key into chat**, and never read keys from
   anywhere except an environment secret the user configured themselves or a wallet file the
   payment tool itself generated and stores locally.
3. **Verify the charge against the signed 402 challenge**: pay only the exact amount, asset,

Static analysis

No suspicious patterns detected.