Trust Assessment
starpulse received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 7 findings: 2 critical, 2 high, 2 medium, and 1 low severity. Key findings include Persistence / self-modification instructions, Unpinned npm dependency version, Configurable external endpoint for sensitive data transmission.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings7
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles. | Manifest | skills/zeph-ai-dev/starpulse/lib/cli.js:282 | |
| CRITICAL | Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles. | Manifest | skills/zeph-ai-dev/starpulse/lib/cli.js:283 | |
| HIGH | Configurable external endpoint for sensitive data transmission The skill transmits signed events, including the agent's public key and user-generated content, to an external relay URL (`RELAY_URL`). This URL is configured via the `STARPULSE_RELAY` environment variable. If an attacker can manipulate this environment variable, they could redirect all skill communications to a malicious server, leading to data exfiltration of user content and agent identity. Implement strict validation or whitelisting for `STARPULSE_RELAY` values. If possible, restrict the environment where this variable can be set or ensure it's only set by trusted sources. Warn users about the risks of setting this to untrusted URLs. | LLM | lib/cli.js:15 | |
| HIGH | Agent secret key stored locally in plain text The `keygen` command generates a cryptographic keypair and stores both the public and secret keys in plain text within `agent.json` in the skill's data directory (`$SKILL_DIR/data/`). While the skill uses this key for local signing and does not transmit the secret key over the network, its local storage makes it vulnerable to credential harvesting if the skill's environment or filesystem is compromised by another malicious process or skill. Consider encrypting the `secretKey` at rest using a master key managed by the host environment or a secure vault. Implement stricter file permissions for `agent.json` to limit access. | LLM | lib/cli.js:70 | |
| MEDIUM | Unpinned npm dependency version Dependency 'tweetnacl' is not pinned to an exact version ('^1.0.3'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/zeph-ai-dev/starpulse/package.json | |
| MEDIUM | User-generated content can contain prompt injection attempts The `post`, `reply`, and `set-profile` commands allow users to input arbitrary text (`content`, `name`, `bio`) which is then stored and transmitted via the Star Pulse relay. If this content is later displayed or processed by another LLM (e.g., when viewing the feed or a profile), it could contain malicious instructions designed to manipulate that LLM. The skill itself does not execute this content, but acts as a vector for its propagation. Implement sanitization or escape mechanisms for user-generated content before it is displayed or processed by any LLM. Downstream LLMs consuming this data should also be aware of this risk and apply appropriate defenses. | LLM | lib/cli.js:83 | |
| LOW | Unpinned dependency `tweetnacl` in package.json The `package.json` file specifies `tweetnacl` with a caret (`^`) version range (`^1.0.3`). While `package-lock.json` pins the exact version, the `package.json` allows for automatic updates to new minor or patch versions. This introduces a slight supply chain risk, as a malicious update to a future `1.x.x` version of `tweetnacl` could be automatically installed, potentially compromising the skill. Pin dependencies to exact versions (e.g., `"tweetnacl": "1.0.3"`) to ensure deterministic builds and prevent unexpected or malicious updates. Regularly audit and update dependencies. | LLM | package.json:6 |
Scan History
Embed Code
[](https://skillshield.io/report/30468b9a2a3ee18b)
Powered by SkillShield