ClawHub
Back to skill

Security audit

NEXUS Changelog

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed paid remote changelog service, but it can send user content and payment credentials to a third-party endpoint without clear per-request consent boundaries.

Review before installing if your changelog input may contain private repository details. Use sandbox mode first, avoid placing broad payment credentials in the environment, and require explicit approval before any paid request or transmission of sensitive source history to the NEXUS endpoint.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-changelog/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The README states the skill is 'automatically invoked' when a matching task is detected, but it provides no clear trigger boundaries, consent requirements, or input constraints. In an agent ecosystem, ambiguous auto-invocation can cause the skill to activate on unintended prompts and send user-supplied content to a remote service, increasing the risk of unreviewed data disclosure or unexpected paid actions.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/changelog \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
93% confidence
Finding
The skill documentation directs users or agents to POST arbitrary input to an external hosted endpoint, which constitutes data egress to a third-party service. In the context of an automatically invoked agent skill, this is dangerous because user prompts, repository content, or sensitive changelog source material could be transmitted off-host without adequate review; the payment/sandbox flow may also normalize remote execution before trust is established.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/changelog \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to POST user-supplied input and a payment proof header to an external third-party service. This creates a real data-exfiltration and credential-disclosure risk because any sensitive content placed in `input`, plus the `NEXUS_PAYMENT_PROOF` secret, is transmitted off-platform to infrastructure outside the local trust boundary.

Static analysis

No suspicious patterns detected.