NEXUS Cron Builder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:34 PM UTC
• Version: 2.1.0

Overview

The skill is a disclosed paid remote cron-expression service, but it asks agents to send user input and payment/transaction material to a third-party host without clear per-request approval or spending controls.

Review this skill before installing. Use it only if you trust NEXUS with cron-related prompts and payment metadata, avoid sending secrets or internal infrastructure details, prefer sandbox testing, and require separate confirmation for every external request, payment, signed transaction, or mandate.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:46
• Finding: Unnecessary External Disclosure of User Input and Payment Authority<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:46-75` **Vulnerability Type**: `other: Unnecessary External Data Disclosure` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### Option A: x402 Standard (Recommended) 1. Call the service endpoint without payment headers. 2. Receive HTTP 402 with `WWW-Authenticate: Payment` header AND x402 `accepts[]` array in response body. 3. Select a `paymentRequirement` from `accepts[]` matching your preferred network + asset. 4. Networks: `cardano:mainnet` (ADA, DJED, iUSD, USDCx, USDM), `stellar:pubnet` (USDC, XLM), `sandbox` (free). 5. Send payment to the `payTo` address for `maxAmountRequired` in the specified asset. 6. **Stellar fee sponsorship:** POST your signed XDR to `https://ai-service-hub-15.emergent.host/api/mpp/stellar/sponsor` — NEXUS pays gas, you need 0 XLM. 7. Retry with `X-PAYMENT: <base64url JSON {x402Version:1, scheme:"exact", network, payload:{tx_hash, currency}}>` header. 8. Parse the JSON response and `X-PAYMENT-RESPONSE` header. ### Option B: MPP Standard 1. Call the service endpoint without payment headers. 2. Receive HTTP 402 with `WWW-Authenticate: Payment` header listing all accepted currencies and amounts. 3. Pick your preferred chain + currency: Cardano (ADA, stablecoins) or Stellar (USDC, XLM). 4. Create payment: Masumi escrow (Cardano) or direct Stellar transfer. 5. **Stellar fee sponsorship:** POST your signed XDR to `https://ai-service-hub-15.emergent.host/api/mpp/stellar/sponsor` — NEXUS pays gas, you need 0 XLM. 6. Retry with `Authorization: Payment <base64url-credential>` header. 7. Parse the JSON response and `Payment-Receipt` header. ### Option C: Legacy Header 1. Send a POST request to the NEXUS API endpoint with your input. 2. Include the `X-Payment-Proof` header (Masumi payment ID or `sandbox_test` for testing). 3. Parse the JSON response and return the result. ``` ### Technical Analysis The skill performs a task that can ordinarily be completed l ...[truncated 3056 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Implement cron-expression generation and explanation locally so ordinary requests do not require network access. 2. Make remote LLM processing explicitly optional rather than the default execution path. 3. Before every external transmission, display: - The exact destination host. - The precise data that will be transmitted. - The provider that will process the data. - The applicable retention and privacy terms. 4. Require affirmative user consent before sending each request externally; installation-time consent alone should not authorize later disclosure. 5. Detect and redact credentials, tokens, internal hostnames, filesystem paths, and other sensitive operational information before transmission. 6. Require a separate confirmation immediately before every payment, transaction signature, or signed-transaction submission. 7. Display the exact asset, network, destination address, amount, estimated fees, and total charge before requesting payment approval. 8. Enforce per-request, daily, and cumulative spending limits independently of values returned by the remote payment challenge. 9. Validate payment destinations and requirements against trusted, pinned configuration rather than relying solely on a server-provided HTTP 402 response. 10. Verify the network, asset, amount, sequence number, operations, and destination encoded in any Stellar XDR before it is signed or submitted. 11. Avoid logging user inputs, payment credentials, authorization headers, transaction payloads, and payment proofs. 12. Document a clear local-only mode and ensure it is the default for sensitive or enterprise environments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-cron-builder/SKILL.md
```

## Usage

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README states the skill is 'automatically invoked' when a matching task is detected, but it does not define matching criteria, approval requirements, or safety boundaries. In an agent ecosystem, ambiguous auto-invocation can cause unintended execution of remote capabilities and increase the chance of prompt-triggered tool use or data being sent to an external service without clear user intent.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/cron-builder \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header

• Confidence: 92% confidence
• Finding: The skill instructs users/agents to POST input to an external hosted service, which creates a real data-exfiltration surface: task content may leave the local environment and be processed by a third party. In the context of an auto-invoked agent skill, this is more dangerous because ordinary user prompts or sensitive scheduling details could be transmitted off-host without sufficiently prominent disclosure or gating.

External Transmission

Medium

• Category: Data Exfiltration

Content

### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/cron-builder \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{

• Confidence: 87% confidence
• Finding: The skill transmits user input and a payment-related proof/header to an external third-party service endpoint. In context, external transmission is part of the skill's stated function, but it still creates a real privacy and supply-chain risk because potentially sensitive prompts and payment metadata leave the local agent boundary and are processed by a remote operator.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The skill is consistently documented elsewhere as a cron expression generator/explainer, but the tags include unrelated domains 'health-monitoring' and 'budget'. While tags are not executable code, this is inline documentation/metadata that misrepresents the skill's intent and could mislead users about what the skill is for.

Static analysis

No suspicious patterns detected.