ClawHub
Back to skill

Security audit

NEXUS Commit Message

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid remote commit-message generator, but users should know it sends their provided text and payment proof to NEXUS.

Install only if you are comfortable sending commit diffs or change summaries and a payment proof to the NEXUS hosted service. Avoid submitting secrets, proprietary code, or sensitive internal changes unless you trust the provider's processing and retention claims.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README promotes a remote commit-message generation service but does not clearly warn that user input and likely commit diffs/repository content are transmitted off-host. Because commit diffs often contain proprietary code, secrets, or sensitive internal context, lack of disclosure materially increases the risk of accidental data exfiltration.

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-commit-message/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The README states the skill is 'automatically invoked' when a matching task is detected, but it does not define the trigger conditions or user-consent boundaries. In the context of a commit-message generator that may process git diffs, this ambiguity can cause unintended activation and silent transmission of repository content to a remote service.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/commit-message \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
88% confidence
Finding
The README explicitly instructs clients to POST input to an external host, confirming off-platform data transmission. In this skill's context, the transmitted input may include commit diffs or repository-derived text, so the external transmission is security-relevant and potentially sensitive even if it is core to the service design.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill is presented as a simple commit-message generator, but it declares a wide set of payment and blockchain protocols, multiple discovery/config endpoints, and a required payment proof environment variable. That is broader than the functional need of the advertised capability and increases the attack surface for unnecessary external interactions, secret handling, and user confusion about what data or funds may be exposed.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/commit-message \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{
Confidence
95% confidence
Finding
The skill explicitly transmits user-provided input and a payment proof header to an external third-party endpoint. In context, this is the core behavior of the skill rather than covert exfiltration, but it is still security-relevant because diffs may contain sensitive source code, secrets, or proprietary changes, and the required payment credential is also disclosed to that service.

Intent-Code Divergence

Low
Confidence
90% confidence
Finding
The manifest describes the skill as generating conventional commit messages from diffs, which implies a specific kind of input. However, the input documentation says the parameter is 'The input text or query,' suggesting a general-purpose prompt or query interface rather than diff-based commit-message generation.

Intent-Code Divergence

Low
Confidence
86% confidence
Finding
The skill is presented as a commit-message generator, but the output documentation merely says 'The service response,' which frames the result as a generic API response rather than a generated conventional commit message. This conflicts with the stated intent of a specialized commit-message skill.

Static analysis

No suspicious patterns detected.