Security audit

OpenNexum TS

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent orchestration CLI, but it under-discloses persistent agent-instruction changes and ships a hard-coded Telegram target plus local runtime/session state.

Review before installing. Use only in a project where you intentionally want Nexum to manage task files and agent workflow state. Remove the shipped `nexum/config.json` notification target and local runtime state, verify `AGENTS.md`/`CLAUDE.md` changes before running `nexum init`, and use a dedicated low-scope Telegram bot token only after confirming the destination chat.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises use of environment variables and networked Telegram/OpenClaw interactions, but declares no permissions. That creates a transparency and governance gap: operators may approve or run the skill without understanding it can read secrets from the environment and transmit data externally. In an agent setting, undeclared capabilities materially increase the chance of unintended secret exposure or policy bypass.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented description understates the skill's behavior relative to the reported capabilities: external notifications, environment credential handling, document modification, callback/evaluation workflow, retry/escalation logic, and session/log inspection. This mismatch is security-relevant because users may trust and invoke the skill for limited orchestration while it performs broader state changes and external communication. In multi-agent tooling, hidden or understated behaviors increase the blast radius of misuse and reduce informed consent.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The README describes Telegram notifications and required credentials but does not disclose that task metadata, status, or other workflow information may be sent to a third-party messaging platform. In an orchestration tool that handles coding tasks and agent activity, this omission can lead operators to enable notifications without understanding the external data exposure and retention implications.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The documentation instructs users to configure Telegram bot credentials and notifications but does not warn that task metadata, status, or other potentially sensitive project information may be sent to a third-party messaging service. This omission can lead to accidental disclosure of internal project details, tokens, task identifiers, or operational data, especially in enterprise environments. Because the skill is specifically about coordinating coding agents, the transmitted content may include sensitive development context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The contract directs an init command to create multiple files and directories in the current working directory, but it does not require any user warning, confirmation, or clear dry-run behavior. In agent-driven or automated contexts, that can lead to unintended filesystem modification, repository pollution, or initialization in the wrong directory, especially if the command is triggered with limited user visibility.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The configuration enables automatic harvesting triggers without any visible scoping, approval gate, or constraint mechanism. In a multi-agent orchestration system, broad auto-trigger behavior can cause unintended task execution, recursive agent activity, or actions to occur on unreviewed state, increasing the chance of unsafe automation and operational abuse.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The prompt explicitly instructs the agent to write a file to a hard-coded local filesystem path, causing a side effect outside the conversational response without any explicit user confirmation or disclosure. In an agentic CLI/orchestration context, this can lead to unauthorized modification of local workspace state, overwrite of existing files, and abuse of the agent as a file-writing primitive.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The prompt explicitly directs the agent to create files and directories in the current working directory, but does not require confirmation, path validation, or any warning that local project state will be modified. In an agent-execution context, this can lead to unintended filesystem changes, especially if the skill is run in the wrong repository or from an unexpected directory.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The prompt explicitly instructs the agent to write output to a fixed absolute filesystem path, which can cause unintended local file modification without clear user consent or runtime disclosure. In an agent skill that may be executed automatically, this creates a real side-effect boundary crossing and can overwrite files or leak evaluation artifacts into sensitive local directories.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The prompt instructs the agent to write output to a hard-coded absolute filesystem path, which can cause unintended file modification without explicit user confirmation. In an agent skill context, fixed-path writes are risky because they couple prompt execution to a local environment and may overwrite files or leak workflow artifacts in ways the user did not approve.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The prompt instructs the evaluator to write results directly to a fixed absolute filesystem path without any disclosure, confirmation, or sandbox constraint. In an agent setting, this can cause unintended file modification on the host system and normalizes hidden side effects from prompt content, which is a real prompt-safety issue even if the target file appears project-local.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The prompt instructs the agent to write output to a fixed absolute filesystem path without any user confirmation or disclosure. In an agent setting, this can cause unintended local file modification and creates a primitive for overwriting artifacts in the workspace or host environment, especially if similar patterns are reused with more sensitive paths.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The command transmits task metadata, including the task name and task ID, to an external Telegram destination without any user-facing disclosure or confirmation in this execution path. In an agent orchestration context, task names can contain sensitive prompts, project identifiers, or internal work details, so this creates a real data-leakage risk if notification settings are enabled or misconfigured.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: packages/spawn/src/spawn.ts:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: packages/spawn/src/status.ts:19

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: packages/notify/src/telegram.ts:25