Civic Nexus

• Analyzed: May 11, 2026, 5:01 AM
• Findings: 1
• Version: 0.1.0
• Hash: db741cdf69089cce9f2948e90ddcebebf7711cb47928c209dae7d6c7fdd01b26
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle for 'civic-nexus' is benign. The `SKILL.md` provides clear, non-malicious instructions for the AI agent to interact with the Civic Nexus MCP, requiring `NEXUS_URL` and `NEXUS_TOKEN` environment variables for legitimate authentication. The core script, `nexus-tool-runner.ts`, uses a dedicated SDK (`@modelcontextprotocol/sdk`) to connect to the specified Nexus endpoint and execute tools. There is no evidence of prompt injection attempts, unauthorized data exfiltration, arbitrary command execution, or persistence mechanisms. All actions are aligned with the stated purpose of bridging OpenClaw with Civic Nexus.