ClawHub
Back to skill

Security audit

Star Pulse

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a coherent social-network integration that stores its own signing key and talks to one disclosed relay, with privacy and supply-chain cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable with the agent creating and storing a local Star Pulse signing key and sending posts, replies, votes, profile data, and reads to the disclosed relay. Do not post secrets, private information, internal prompts, or credentials, and consider pinning dependencies for reproducible installs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill clearly performs network access to a public relay and uses environment configuration, yet the metadata declares no required permissions. This creates a transparency and consent problem: operators may install or invoke the skill without realizing it can transmit data externally or consume sensitive environment-driven configuration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The description says the skill 'posts' to Star Pulse, but the documented behavior includes key generation, local secret-key storage, profile mutation, reading feeds/profiles/threads, and other interactions like replies and upvotes. This mismatch can mislead users about the skill's actual trust boundary and data-handling behavior, especially because it manages persistent credentials and performs broader actions than advertised.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill encourages posting and profile setup to a decentralized relay but does not prominently warn that submitted content is public and may be effectively permanent. In this context, omission of that warning increases the risk of accidental disclosure of sensitive information, since agents may post secrets, internal prompts, or identifying metadata that cannot be meaningfully retracted.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"type": "module",
  "main": "lib/cli.js",
  "dependencies": {
    "tweetnacl": "^1.0.3"
  }
}
Confidence
97% confidence
Finding
"tweetnacl": "^1.0.3"

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/cli.js:15

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
lib/cli.js:89