T09 · Insecure Skill Coding Practices
Error
- Location
nexus-tool-runner.ts:33- Finding
Bearer Token May Be Transmitted to an Arbitrary or Plaintext Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Civic Nexus
Security checks for vulnerabilities and agentic risk
Overview
This looks like a real Nexus bridge, but it gives agents very broad access to connected services and handles a bearer token without enough destination or action safeguards.
Install only if you trust Civic Nexus, the configured MCP URL, and every connected service profile exposed through the token. Use a least-privilege Nexus token/profile, keep NEXUS_URL on the official HTTPS Nexus endpoint, avoid unpinned global or npx execution paths, and require explicit review before the agent performs write, delete, posting, database, email, or storage actions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:42- Finding
Unpinned Package Installation and Potential On-Demand Registry Execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (31)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 1. Get your Nexus credentials 1. Go to [nexus.civic.com](https://nexus.civic.com) and sign in 2. Get your **MCP URL** and **access token** from your profile settings ### 2. Configure in OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts ### 1. Get your Nexus credentials 1. Go to [nexus.civic.com](https://nexus.civic.com) and sign in 2. Get your **MCP URL** and **access token** from your profile settings ### 2. Configure in OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts ### 1. Get your Nexus credentials 1. Go to [nexus.civic.com](https://nexus.civic.com) and sign in 2. Get your **MCP URL** and **access token** from your profile settings ### 2. Configure in OpenClaw
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill requests sensitive environment variables and instructs the agent to execute external commands, but it does not declare explicit tool scope or allowed-tools constraints. That makes the skill's operational boundaries ambiguous and increases the chance an agent will use broader execution capabilities than intended when handling credentials and remote integrations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction to use Nexus whenever the user asks to interact with external services is broad and lacks clear boundaries on which services, operations, or trust checks are permitted. In a bridge to 100+ integrations, vague activation criteria can lead an agent to overuse the skill, access unrelated data, or perform unintended actions on high-value services.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx tsxwithout pinning a specific package version introduces a supply-chain risk because package resolution may fetch whatever version is current at execution time. If a compromised or malicious release is published, the agent could execute attacker-controlled code in the local environment with access to Nexus credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This invocation again relies on unpinned
npx tsx, which can download and run an unverified package version at runtime. In a skill that handles bearer tokens and external service access, that creates a meaningful path to credential theft or arbitrary code execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The schema lookup command still depends on unpinned
npx tsx, preserving the same supply-chain execution risk. Even read-only seeming operations are dangerous because the package itself executes before the script and can access environment variables and filesystem contents.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Calling tools through
npx tsxwithout version pinning exposes the host to arbitrary code from the npm ecosystem at the moment of use. Because this command may run with access toNEXUS_TOKEN, compromise could lead directly to unauthorized access to Gmail, databases, or other connected systems.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The continuation flow also uses unpinned
npx tsx, so the same supply-chain vulnerability applies during OAuth follow-up operations. That is especially sensitive because these flows often occur after privileged authorization has just been granted.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The stated design goal is to 'Call any tool with arguments,' which indicates unrestricted access to all server-exposed capabilities using the holder's Nexus token. Because this skill connects to a large integration hub, broad tool access can enable execution of destructive database actions, inbox/search access, external API operations, or other sensitive actions without local authorization controls.
- Content
ts * - List all available tools * - Search tools by name/description * - View tool schemas * - Call any tool with arguments * * Usage: * npx tsx nexus-tool-runner.ts --list
Static analysis
No suspicious patterns detected.