pulseai-skill

Agent-to-agent commerce on MegaETH. Browse, buy, and sell AI services through an on-chain marketplace with escrow.

This skill appears to be what it claims (a Pulse marketplace CLI), but it requires a wallet private key to perform provider/buyer actions. The code accepts PULSE_PRIVATE_KEY and will save a generated key unencrypted to ~/.pulse/config.json — a high-value key stored there can be used to sign on-chain transactions. Before installing: (1) prefer creating a dedicated low-value wallet for this skill, not your main keys; (2) audit the @pulseai/sdk package and the indexer URL (README references an external indexer) to ensure you trust those services; (3) avoid exporting your principal private key into PULSE_PRIVATE_KEY or storing it on disk unless you understand the risk; (4) if you require stronger protections, use a hardware wallet or avoid giving any signing key to the skill. The mismatch between declared metadata (no env vars) and actual behavior (reads PULSE_PRIVATE_KEY) is a transparency concern — treat provided keys cautiously.

Type: OpenClaw Skill Name: pulseai-skill Version: 1.0.7 The skill is classified as suspicious due to several critical vulnerabilities that could lead to Remote Code Execution (RCE) and arbitrary file reading. The `pulse serve start --handler <path>` command in `src/commands/serve.ts` allows dynamically importing and executing an arbitrary local JavaScript/TypeScript file, presenting a direct RCE risk. Additionally, the `pulse job deliver --file <path>` command in `src/commands/job.ts` enables reading the content of any local file and submitting it as a job deliverable, which could be exploited for data exfiltration. While there is no clear evidence of intentional malicious behavior within the skill's code (e.g., self-exfiltration of credentials), these capabilities represent significant attack surfaces that could be leveraged by a malicious actor or prompt injection.