Nuwa World - OSINT Human Research

ReviewAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill transparently uses Nuwa's API for face search and research, but users should know it sends images or queries to an external service and uses their API credits.

Install only if you intend to use Nuwa's external API for face search or deep research. Before invoking it, verify the exact photo or query being submitted, understand the credit costs, and avoid sending sensitive personal data unless you are comfortable with Nuwa processing it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A selected face image can be sent to Nuwa's service, and the upload costs 10 credits.

Why it was flagged

The skill teaches the agent to use curl to upload a local image to Nuwa's remote API. This is the advertised face-search function, but it is still a file upload/network action that should be user-directed.

Skill content

curl -X POST https://gateway.nuwa.world/api/v1/face-search ... -F "image=@photo.jpg"

Recommendation

Confirm the exact image and endpoint before running the command, and avoid letting the agent choose arbitrary local files.

Low

#ASI03: Identity and Privilege Abuse

What this means

If the key is exposed or overused, the user's Nuwa credits or API access could be affected.

Why it was flagged

The skill requires a Nuwa API key and sends it with each API call. This is expected for the service, but it gives the agent delegated access to the user's Nuwa account/credits.

Skill content

Auth: `X-API-Key: $NUWA_API_KEY` header on every request.

Recommendation

Use a dedicated or limited API key if available, store it only as an environment variable, and avoid sharing command logs that include secrets.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Photos of people and person-focused research queries may be processed by Nuwa's external service.

Why it was flagged

The skill clearly sends face images and research queries to an external provider. The destination is disclosed, but these inputs can be privacy-sensitive identity data.

Skill content

**Face Search** — upload a face image, get matching URLs across the internet
- **Deep Research** — submit a question, get a structured summary with citations

Base URL: `https://gateway.nuwa.world/api/v1`

Recommendation

Only submit images and queries you are allowed to share, and review Nuwa's privacy and retention policies before using sensitive personal data.