Nuwa World - OSINT Human Research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:39 PM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it enables third-party face search and person research without enough consent, privacy, or lawful-use guidance.

Install only if you are comfortable sending uploaded face images and research queries to Nuwa's service. Use it only with images and people you are authorized to investigate, keep the API key in an environment variable, and review the provider's privacy, retention, and legal terms before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill explicitly instructs users to upload face images to a third-party API for internet-wide matching, which involves transmission of highly sensitive biometric data. The documentation does not provide an explicit privacy warning, consent requirement, retention/disclosure notice, or guidance on lawful use, making accidental misuse and non-compliant handling of biometric data materially more likely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README promotes face search and open-web person research, which are privacy-sensitive capabilities involving biometric and personal data, but it does not warn users about consent, lawful basis, or the risks of identifying or profiling individuals. In this skill context, that omission is more dangerous because the documented workflow makes surveillance-style use straightforward for an agent operator.

External Transmission

Medium

• Category: Data Exfiltration

Content

`POST /face-search` with multipart form data:

   ```bash
   curl -X POST https://gateway.nuwa.world/api/v1/face-search \
     -H "X-API-Key: $NUWA_API_KEY" \
     -F "image=@photo.jpg"
   ```

• Confidence: 90% confidence
• Finding: This documented API call uploads a face image and API credential to an external endpoint, which is a real external-transmission behavior. In context, the risk is elevated because the transmitted content is biometric data tied to identity search, so misuse or uninformed use can expose highly sensitive personal information to a third party.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cd /path/to/your-project

mkdir -p .cursor/skills
cp -r /path/to/nuwa-world-api-skill .cursor/skills/nuwa-world-api-skill
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

env:
        - NUWA_API_KEY
      bins:
        - curl
    primaryEnv: NUWA_API_KEY
    emoji: "🔍"
    homepage: https://gateway.nuwa.world/docs

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The README instructs users to configure an API key and send requests to a third-party service, but it does not clearly warn that images, queries, and metadata will leave the local environment and be transmitted to Nuwa's infrastructure. In an agent skill, this matters because users may assume local processing while the skill is actually enabling external disclosure of potentially sensitive inputs.

Static analysis

No suspicious patterns detected.