NEXUS Data Transform

ReviewAudited by ClawScan on May 10, 2026.

Overview

This data-conversion skill is transparent about using a paid external service, but it may let an agent incur per-request charges without clear per-use approval or spending limits.

Review this skill before installing if you do not want your agent to make paid API calls. Start with `sandbox_test`, require confirmation for any real payment, set spending limits, and avoid sending sensitive data unless you trust NEXUS.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

Your agent could use the service for matching tasks and incur repeated small charges if real payment capability is available.

Why it was flagged

Automatic skill invocation combined with per-request pricing creates a material risk of unintended charges because the artifacts do not describe a per-call confirmation, budget, or spending cap.

Skill content

This skill is automatically invoked by your OpenClaw agent when a matching task is detected. ... **$0.10** per request

Recommendation

Use the sandbox proof for testing, and only provide real payment credentials if your agent runtime enforces explicit confirmation and spending limits for each paid call.

Low

#ASI03: Identity and Privilege Abuse

What this means

A real payment proof may authorize paid access to the provider service.

Why it was flagged

The skill requires a payment proof and sends it as an API credential to the NEXUS endpoint; this is expected for the paid service but is still sensitive.

Skill content

requires:
  env: [NEXUS_PAYMENT_PROOF] ... `X-Payment-Proof: <masumi_payment_id>`

Recommendation

Use a limited or test payment proof where possible, avoid sharing unrelated secrets in this variable, and rotate/revoke it if exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any data you ask the skill to convert leaves your local environment and is processed by NEXUS.

Why it was flagged

The skill clearly discloses that user input is sent to an external provider and processed server-side by AI models.

Skill content

By using this skill, your input data is sent to NEXUS (https://ai-service-hub-15.emergent.host) for AI processing.

Recommendation

Do not send confidential or regulated data unless you trust the provider and its retention/privacy terms.