ClawHub
Back to skill

Security audit

NEXUS Data Profile

Security checks for vulnerabilities and agentic risk

Overview

This is a paid remote data-profiling skill that clearly sends user input to NEXUS for processing and does not request local file or shell access.

Install only if you are comfortable sending the text or dataset content you provide to NEXUS over the network and using its payment proof flow. Avoid submitting secrets, regulated personal data, or proprietary datasets unless you trust the provider and have authorization.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-data-profile/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The README states the skill is 'automatically invoked' when a matching task is detected, but provides no concrete trigger boundaries, consent model, or examples of safe/unsafe activation. In a skill ecosystem, ambiguous auto-invocation can cause users or agents to send data to the service unexpectedly, increasing the risk of unintended remote processing and privacy exposure.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill is a data profiler that appears designed to accept dataset content and send it to a remote endpoint, but the README does not clearly warn users that their dataset contents may leave the local environment. This omission is dangerous because users may submit sensitive, proprietary, or regulated data without realizing it is being transmitted to a third-party hosted service.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/data-profile \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
97% confidence
Finding
The README explicitly instructs users to POST input to an external service endpoint, confirming remote transmission of potentially sensitive data. In the context of a data profiling skill, this is particularly risky because uploaded datasets may contain confidential business data, personal information, or secrets, and the documentation does not pair the transmission with clear security, privacy, or sanitization warnings.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/data-profile \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to transmit user-provided input and a payment proof to a third-party remote service. This is a real external data exfiltration surface because any data passed to the skill leaves the local trust boundary, and the skill also encourages sending a secret-bearing credential via header. The surrounding trust/privacy statements do not mitigate the risk because they are unverified claims inside potentially adversarial content.

Static analysis

No suspicious patterns detected.