Pulse Skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:03 AM UTC
• Version: 1.0.0

Overview

The skill is aligned with Aicoo/Pulse syncing and sharing, but its broad hooks and scheduled sync scripts can expose project or conversation data without enough scoping or confirmation.

Install only if you intend to give the agent authenticated access to your Aicoo/Pulse workspace. Before enabling hooks, loops, routines, or cron jobs, narrow them to explicit Pulse tasks, review exactly which files or messages will be sent, avoid all-workspace share scopes unless deliberate, and treat MCP/integration changes as admin-level actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/claude-code/settings-example.json:3

Finding

Global Claude Code hook injects cloud-sync instructions into unrelated sessions

Content

View full analysis

Pulse is connected. After completing this task, consider: - Did the conversation produce knowledge worth syncing? → POST /os/notes/search, then create/edit note - Should the shared agent know about this? → POST /accumulate or /os/notes - Major changes coming? → POST /os/snapshots/{noteId} first - Need to share with someone? → POST /os/share with scope + access control EOF ``` ### Technical Analysis The `UserPromptSubmit` matcher is empty, so the command runs for every submitted prompt rather than only for requests involving Pulse. Its output is inserted into the agent's active context and directs the agent to consider sending conversation knowledge, project information, and other material to Aicoo. The hook does not directly upload data, and its installation is documented as optional. Nevertheless, after installation it changes the goals of unrelated sessions by introducing a standing cloud-synchronization objective. There is no per-task relevance check, upload preview, sensitivity check, or explicit user confirmation requirement in the injected instruction. ### Attack Path 1. A user copies the documented hook configuration into `.claude/settings.json`. 2. The user starts an unrelated task involving private project or conversation information. 3. Because the matcher is empty, `pulse-activator.sh` runs on prompt submission. 4. The agent receives instructions to consider creating, editi ...[truncated 563 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/openclaw/handler.js:5

Finding

OpenClaw bootstrap hook adds persistent cross-task synchronization instructions

Content

View full analysis

"} 2. If found: snapshot then edit — don't create duplicates 3. If new: POST /os/notes with clear title and content 4. For bulk changes: use POST /accumulate with file array **Check staleness:** GET /os/status — if lastSyncedAt > 24h, do a sync pass.`; module.exports = async function handler(event) { if (!event || typeof event !== 'object') return; if (event.type !== 'agent' || event.action !== 'bootstrap') return; if (!event.context || typeof event.context !== 'object') return; const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) return; if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'PULSE_SYNC_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` ### Technical Analysis The handler modifies the bootstrap context of every main OpenClaw agent session by adding a virtual instruction file. The injected content tells the agent to upload decisions, preferences, architecture details, project context, and meeting outcomes, and to perform a synchronization pass based on staleness. The handler excludes subagents but does not check whether the current user request concerns Pulse. Consequently, enabling the hook establishes a cross-task behavioral directive that can affect sessions unrelat ...[truncated 1050 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pulse-sync.sh:34

Finding

Scheduled sync uploads recently modified Markdown files without a content allowlist

Content

View full analysis

/dev/null | head -20 || true) # Build sync payload FILES_JSON="[]" for f in $MODIFIED_FILES; do CONTENT=$(cat "$f" 2>/dev/null || continue) FOLDER=$(dirname "$f" | sed 's|^\./||' | sed 's|/|-|g') [ "$FOLDER" = "." ] && FOLDER="General" BASENAME=$(basename "$f") FILES_JSON=$(echo "$FILES_JSON" | jq \ --arg path "$FOLDER/$BASENAME" \ --arg content "$CONTENT" \ '. + [{path: $path, content: $content}]') done FILE_COUNT=$(echo "$FILES_JSON" | jq 'length') if [ "$FILE_COUNT" -gt 0 ]; then RESULT=$(curl -s -X POST "$PULSE_BASE/accumulate" \ -H "$AUTH" \ -H "Content-Type: application/json" \ -d "{\"files\": $FILES_JSON}") fi ``` ### Technical Analysis The scheduled script discovers all recently modified Markdown files within three directory levels and sends their complete contents to `https://www.aicoo.io/api/v1/accumulate`. Only `.git` and `node_modules` are excluded. The implementation has no explicit file manifest, path allowlist, sensitive-file denylist, secret scanning, content preview, per-file approval, or dry-run requirement. Markdown files frequently contain credentials, private planning documents, incident reports, customer data, personal notes, or confidential architecture information. The use of `head -20` limits the number of files per execution but does not constrain sensitivity. The behavior is directly related to the declared automatic-sync capability, and cron setup is explicit and optional. However, the data-selection scope exceeds least-data principles because scheduling synchronization of a project does not imply consent to ...[truncated 1268 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pulse-sync.sh:38

Finding

Predictable shared temporary files permit state manipulation and symlink-based writes

Content

View full analysis

/dev/null | head -20 || true) if [ -z "$CHANGES" ] && [ -z "$MODIFIED_FILES" ]; then echo "[$(date)] No changes detected, skipping sync" touch /tmp/.pulse-last-sync exit 0 fi touch /tmp/.pulse-last-sync ``` From `scripts/inbox-monitor-cron.sh`: ```bash STATE_FILE="${PULSE_INBOX_STATE_FILE:-/tmp/pulse-inbox-monitor-state.json}" if [ ! -f "$STATE_FILE" ]; then echo "{\"lastCheckedAt\":\"1970-01-01T00:00:00Z\"}" > "$STATE_FILE" fi LAST_CHECKED_AT=$(jq -r '.lastCheckedAt // "1970-01-01T00:00:00Z"' "$STATE_FILE") jq -nc --arg ts "$NOW_UTC" '{lastCheckedAt:$ts}' > "$STATE_FILE" ``` ### Technical Analysis Both scripts use fixed names in the system-wide temporary directory without secure creation, ownership validation, symlink rejection, restrictive permissions, or atomic replacement. On a multi-user system, another local user can pre-create one of these predictable paths before the first scheduled execution. A symbolic link at the inbox state path can redirect shell output to another file writable by the cron user. Manipulating the sync timestamp can also suppress or alter file-selection behavior because the marker controls the `find -newer` comparison. The maximum effect remains bounded by the files that the cron account can modify. This is not a mechanism for obtaining root privileges unless the scripts are independently and unsafely scheduled as root. ### Attack Path 1. A local attacker predicts `/tmp/.pulse-last-sync` or `/tmp/pulse-inbox-monitor-state.json`. 2. Before the legitimate user's first run, the attacker creates the pa ...[truncated 755 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (118)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 39)May include surrounding context.

md

- **Canonical v1 endpoints enforced in skills docs** — all examples now teach canonical paths first:
  - `GET /os/status` (instead of `/context/status`)
  - `GET/POST /os/folders` (instead of `/context/folders`)
  - `GET /os/share/list` + `PATCH/DELETE /os/share/{linkId}` (instead of `/share/*`)
- **Legacy/fantasy endpoints removed from references** — replaced non-canonical or non-existent link-audit endpoints with real `/os/*` + `/accumulate` flows.

### Added

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/examine-sandbox/reference/API.md (reported line 84)May include surrounding context.

md

- **Canonical v1 endpoints enforced in skills docs** — all examples now teach canonical paths first:
  - `GET /os/status` (instead of `/context/status`)
  - `GET/POST /os/folders` (instead of `/context/folders`)
  - `GET /os/share/list` + `PATCH/DELETE /os/share/{linkId}` (instead of `/share/*`)
- **Legacy/fantasy endpoints removed from references** — replaced non-canonical or non-existent link-audit endpoints with real `/os/*` + `/accumulate` flows.

### Added

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 45)May include surrounding context.

md

### Added
- **Tools integration management docs**:
  - `GET /tools/integrations`
  - `DELETE /tools/integrations/{id}`
  - `POST /tools/mcp/{id}/disconnect`
  - `GET/PUT /tools/namespaces`
- **Updated reference guides**:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 271)May include surrounding context.

md

- `POST /tools/mcp` add server
- `GET /tools/mcp/{id}` inspect one server
- `PATCH /tools/mcp/{id}` update name/url/config/status
- `DELETE /tools/mcp/{id}` remove server
- `POST /tools/mcp/{id}/authorize` start OAuth (returns `authorizeUrl`)
- `POST /tools/mcp/{id}/refresh` run health check + discover tools
- `POST /tools/mcp/{id}/disconnect` clear OAuth binding

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents this as an operational Pulse skill with many end-user capabilities and triggers across sharing, syncing, note management, briefings, and agent-network actions. The supplied code does something much narrower and materially different: it only listens for an agent bootstrap event and appends a virtual file PULSE_SYNC_REMINDER.md with instructional text to event.context.bootstrapFiles, skipping subagent sessions. There are no API requests, no file/context sync, no note reads/writes, no link management, no network requests, and no briefing or inbox features. This is not merely an implementation detail omission; the primary purpose in code is a bootstrap-time reminder/instruction injection, which is not accurately represented by the broad declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This is a material description-behavior mismatch. The declared purpose describes a full-featured Pulse skill with many user-facing capabilities and triggers. The supplied code only runs as an OpenClaw hook during agent bootstrap, skips sub-agent sessions, and appends a virtual file named PULSE_SYNC_REMINDER.md to bootstrapFiles. That file contains guidance about how an agent might use Pulse endpoints later, but the hook itself does not execute those operations. The primary purpose is therefore bootstrap-time reminder injection, not Pulse sharing/sync/note/network management.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

There is a substantial description-behavior mismatch. The description presents this as an operational Pulse skill that can carry out many concrete actions across notes, sharing, syncing, briefings, and agent networking. The code instead only prints advisory text based on whether an environment variable exists. Its primary purpose is to remind or nudge the host system/operator about Pulse capabilities after a prompt submission, not to execute the listed functionality. While the reminder text references relevant Pulse endpoints, the script itself does not call them or manage any resources. This is therefore materially different in both primary purpose and implemented capabilities.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 84% confidence

Finding

The MCP management section includes listing and adding MCP servers, which can expose sensitive integration metadata or enable connection to arbitrary third-party servers. In an agent skill, access to MCP configuration is high risk because it expands the trust boundary and can facilitate data exfiltration through newly attached tool backends.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

MCP server lifecycle runbook (/tools/mcp)

bash

# list MCP servers
curl -s "$PULSE_BASE/tools/mcp" \
  -H "Authorization: Bearer $PULSE_API_KEY" | jq .

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/integrations/verified-mcps.md (reported line 58)May include surrounding context.

md

- `disconnected`
- `error`

No access tokens or refresh tokens are returned by this endpoint.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is explicitly designed to send local files, notes, and other context to a remote Pulse service, but it does not prominently warn users that sensitive local content may leave the host environment. Because the skill supports bulk sync and knowledge upload, the lack of disclosure materially increases the risk of accidental data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to generate daily briefings from Pulse context, which can include notes, calendar, todos, and email-derived summaries, but it does not disclose that sensitive personal or workplace data will be transmitted to a third-party remote API. This lack of informed-consent warning increases the risk of accidental exfiltration of confidential information during normal use.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/examine-sandbox/examples/audit-link.md (reported line 38)May include surrounding context.

Recommended action:

1. PATCH /os/share/{linkId} scope -> folders
2. PATCH /os/share/{linkId} notesAccess -> read
3. DELETE /os/share/{linkId} if you want immediate revoke

text

## What the agent did

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/examine-sandbox/reference/API.md (reported line 53)May include surrounding context.

Recommended action:

1. PATCH /os/share/{linkId} scope -> folders
2. PATCH /os/share/{linkId} notesAccess -> read
3. DELETE /os/share/{linkId} if you want immediate revoke

text

## What the agent did

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/share-agent/reference/API.md (reported line 44)May include surrounding context.

Recommended action:

1. PATCH /os/share/{linkId} scope -> folders
2. PATCH /os/share/{linkId} notesAccess -> read
3. DELETE /os/share/{linkId} if you want immediate revoke

text

## What the agent did

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent/user to scan local docs and upload file contents to a remote service without requiring a privacy warning, consent checkpoint, or content review step. In this context, onboarding is especially risky because first-time users may not understand what sensitive material exists in README files, docs, notes, or project artifacts before synchronization.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill creates a share link with 'scope':'all' and read access by default, without warning that this may expose the entire workspace or all notes available through the share mechanism. This is particularly dangerous in an onboarding skill because new users are least likely to understand sharing boundaries and may unintentionally publish far more information than intended.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The instruction to 'collect context' by asking business questions and then scanning local files creates a clear pathway for aggregating sensitive context and transmitting it onward. In this skill's context, the data likely includes strategic, financial, technical, and personal information, making context leakage more dangerous than in a generic note-taking example.

Content

Scanner excerpt · skills/onboarding/examples/first-time-setup.md (reported line 26)May include surrounding context.

-H "Authorization: Bearer $PULSE_API_KEY" | jq .

text

### Step 4: Explore and collect context

Ask startup basics (product, team, traction, boundaries), then scan local files.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documentation enumerates destructive and permission-changing operations such as restoring snapshots, editing notes, revoking share links, sending network requests, accepting connections, and disconnecting integrations without consistently requiring confirmation, least-privilege guidance, or user-impact warnings. In an agent skill context, this can normalize unsafe autonomous execution and lead an agent to perform data-loss, sharing, or access-control changes on behalf of a user without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Claude hook example uses an empty matcher, which causes the activator script to run on every user prompt rather than a narrowly scoped subset. In a skill centered on syncing, sharing, and agent-to-agent communication, this broad trigger increases the chance of unintended activation, over-collection of context, or accidental outbound actions tied to sensitive prompts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 179)May include surrounding context.

Standalone (cron)

bash

# crontab -e
0 9 * * * /path/to/aicoo-skills/scripts/pulse-sync.sh /path/to/project
30 8 * * 1-5 /path/to/aicoo-skills/scripts/daily-brief-cron.sh
*/15 * * * * /path/to/aicoo-skills/scripts/inbox-monitor-cron.sh

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises and demonstrates network and shell-capable operations but does not declare explicit tool scope or allowed tools. In a skill system, missing scope declarations weakens reviewability and can enable broader-than-expected external access, especially for commands that transmit workspace data or invoke remote services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is extremely broad and overlaps with common user requests like sharing, syncing, searching notes, updates, and messaging. Overbroad activation can cause the skill to engage in situations the user did not intend, increasing the chance of unsolicited external transmission, network actions, or context exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.