ClawHub
Back to skill

Security audit

NEXUS Ap2 Batched Settle

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent payment-settlement skill, but it deserves Review because it can create payment mandates and prepare wallet transactions through a hosted service with limited adjacent safety warnings.

Install only if you intentionally want an agent-payment workflow tied to the NEXUS hosted service. Use testnet and sandbox signatures first, verify the endpoint and network, never share wallet seeds or private keys, and independently check every amount, destination, currency, issuer, mandate, and trust line before signing or broadcasting any XRPL transaction.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README includes copy-pastable commands that create payment mandates and prepare a batch settlement transaction without an explicit warning that these actions may create financial obligations or lead directly to blockchain payment execution after signing. In a payment-oriented agent skill, omission of such warnings increases the risk of accidental authorization, misuse by downstream agents, and social-engineering-style prompting around real funds.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 1. Mint a cart mandate
MID=$(curl -sX POST https://ai-service-hub-15.emergent.host/api/ap2/mandates/create \
  -H "Content-Type: application/json" \
  -d '{
    "mandate_type": "cart",
Confidence
83% confidence
Finding
This example sends data to an external hosted endpoint to mint a payment mandate, which is a state-changing financial operation rather than a passive documentation example. Because the skill is specifically about agent payments, the context makes the transmission more sensitive: a user or autonomous system could blindly execute it and create obligations or disclose identifiers to a third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
}' | jq -r .mandate_id)

# 2. Build unsigned batch tx (using multiple mandate IDs)
curl -X POST https://ai-service-hub-15.emergent.host/api/ap2/payments/batch \
  -H "Content-Type: application/json" \
  -d "{\"mandate_ids\":[\"$MID\"],\"payer_address\":\"r<your-xrpl-address>\",\"chain\":\"xrpl\",\"mode\":\"ALLORNOTHING\"}"
```
Confidence
89% confidence
Finding
This example posts mandate IDs and a payer XRPL address to an external API that builds an unsigned batch payment transaction. Even though it is unsigned, it prepares a concrete payment artifact that can be signed and submitted, so presenting it without a clear safety warning materially increases the chance of unintended financial action, especially in an autonomous-agent setting.

External Transmission

Medium
Category
Data Exfiltration
Content
For an **Intent Mandate** (agent autonomy, e.g. "spend up to 10 XRP this week"):

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/ap2/mandates/create \
  -H "Content-Type: application/json" \
  -d '{
    "mandate_type": "intent",
Confidence
93% confidence
Finding
The skill transmits sensitive payment-authorization data to an external host, including user identifiers, agent identifiers, mandate details, and signature objects. In a payment skill, this increases risk because an agent could exfiltrate financial metadata or route users into authorizing payments against a third-party service endpoint without strong origin validation, data-minimization guarantees, or explicit trust boundaries.

Static analysis

No suspicious patterns detected.