ClawHub
Back to skill

Security audit

NEXUS Data Transform

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paid remote data-conversion skill that sends user input to NEXUS, with no local filesystem or shell authority requested.

Install this only if you are comfortable sending the data you ask to convert, plus payment proof or payment credentials, to NEXUS at ai-service-hub-15.emergent.host. Avoid using it for secrets, credentials, regulated data, or private documents unless you trust that provider and its retention claims.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-data-transform/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The README states the skill is 'automatically invoked' when a matching task is detected, but provides no concrete trigger boundaries, approval requirements, or data-handling constraints. In an agent environment, ambiguous auto-invocation can cause the skill to run on unintended prompts and send user data to a remote service without clear user awareness.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The README describes remote API usage but does not clearly warn that user-provided content will be transmitted off-host to an external domain. This is dangerous because agents may forward sensitive prompts, files, or structured data to a third-party service without informed consent, creating confidentiality and compliance risks.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/data-transform \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
95% confidence
Finding
The documented workflow sends request content to an external service endpoint, which is a real security concern in the context of an automatically invoked agent skill. Even though remote processing is the intended product behavior, external transmission becomes dangerous when the README does not pair it with clear consent, scope limits, or restrictions on sensitive data.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/data-transform \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{
Confidence
91% confidence
Finding
The skill explicitly sends user-provided input and a payment proof header to an external third-party endpoint for processing. This creates a real data exposure boundary: sensitive prompts, proprietary content, or regulated data could be transmitted off-platform to NEXUS and handled by downstream LLM services, increasing confidentiality and compliance risk if users are unaware or if sensitive data is passed through.

Natural-Language Policy Violations

Low
Confidence
9% confidence
Finding
I reviewed the natural-language content for organizational language or locale policy violations. Although this line mentions server-side model processing, it does not require a specific language or locale, so it does not clearly violate the stated policy category.

Static analysis

No suspicious patterns detected.