NEXUS Data Validation

ReviewAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill appears to be a legitimate paid remote data-validation API, but it needs review because automatic matching invocations could incur per-request charges without a documented approval or budget limit.

Install only if you trust NEXUS, are comfortable sending validation data to its hosted AI endpoint, and have configured OpenClaw to ask before paid calls or enforce a spending limit. Prefer the sandbox mode or a limited payment proof for testing, and avoid sending sensitive data unless the provider's terms meet your needs.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If payment credentials are configured, routine or repeated matching tasks could incur charges without the user noticing each request.

Why it was flagged

This combines automatic invocation with a paid per-request service, but the artifacts do not specify per-call user confirmation, a maximum budget, or rate limits.

Skill content

"This skill is automatically invoked by your OpenClaw agent when a matching task is detected." ... "Pricing" ... "$0.18 per request"

Recommendation

Require explicit approval for paid calls or configure a hard budget and rate limit; use sandbox_test by default until payment behavior is understood.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent run that can use this environment value may be able to consume the associated paid service access.

Why it was flagged

The skill requires a payment proof or payment credential to access the paid API. This is expected for the service, but it is still sensitive authority.

Skill content

requires:
  env: [NEXUS_PAYMENT_PROOF] ... Headers: ... X-PAYMENT ... Authorization: Payment ... X-Payment-Proof

Recommendation

Use a limited or sandbox payment proof, store it securely, and rotate or revoke it if it is exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Data submitted for validation leaves the local environment and is processed by the NEXUS service.

Why it was flagged

The skill clearly discloses that user input is sent to a hosted AI provider, which creates a data-sharing boundary even though it is purpose-aligned.

Skill content

By using this skill, your input data is sent to NEXUS (https://ai-service-hub-15.emergent.host) for AI processing.

Recommendation

Only send data you are comfortable sharing with NEXUS, and review the provider's terms before using it with sensitive or regulated information.