ClawHub
Back to skill

Security audit

NEXUS Doc Writer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed paid remote documentation service, but its payment flow can direct blockchain payments from server-provided terms without a clear per-payment user approval or local validation gate.

Install only if you trust NEXUS with the code/specs you submit and with the payment workflow. Use sandbox_test first, avoid sending secrets or confidential source unless approved, and require manual confirmation plus local checks of recipient, chain, asset, and amount before any real payment.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:57
Finding

Server-Controlled Payment Requirements Lack an Explicit User Approval and Local Validation Gate

Content
View full analysis
` header. 8. Parse the JSON response and `X-PAYMENT-RESPONSE` header. ``` Related behavior at `README.md:16`: ```markdown This skill is automatically invoked by your OpenClaw agent when a matching task is detected. ``` ### Technical Analysis The documented workflow directs an agent to obtain a payment requirement from a remote HTTP 402 response and then transfer the remotely specified `maxAmountRequired` to the remotely specified `payTo` address. The instructions do not require: - Explicit user confirmation immediately before payment. - Validation of the recipient against a locally trusted allowlist. - Enforcement of the advertised `$0.25` per-request maximum. - Independent validation of the selected chain, asset, and amount. - Rejection of unexpected or changed payment requirements. Because the skill can be automatically invoked for matching tasks, an agent with wallet or transaction-signing capabilities could proceed from an ordinary documentation request to a financial operation without a mandatory consent gate. HTTPS protects transport confidentiality and integrity but does not protect against a compromised, malicious, or misconfigu ...[truncated 2088 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

Or manually copy the SKILL.md to your OpenClaw skills directory:

bash
cp SKILL.md ~/.openclaw/skills/nexus-doc-writer/SKILL.md

Usage

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states the skill is 'automatically invoked' when a matching task is detected, but it does not define what constitutes a match or what user content may be transmitted. Ambiguous trigger boundaries can cause unintended activation and unexpected data handling, which is risky for a skill that calls a remote paid service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README instructs users to send arbitrary 'input' to a third-party remote endpoint but provides no warning about privacy, retention, logging, or handling of sensitive code/specifications. Because this skill is for documentation generation from code or specs, the likely payload may include proprietary or secret material, making silent transmission materially dangerous.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The README explicitly directs sending user-provided content to an external service endpoint. External transmission is not inherently malicious, but in this context the service processes code/specifications and the documentation does not pair the network call with consent, minimization, or secret-handling guidance, creating risk of data exfiltration or disclosure.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/doc-writer \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This skill explicitly sends user-provided input and a payment proof to an external third-party service endpoint over the network. That creates a real data exposure boundary: sensitive code, specs, or internal documentation content may leave the local agent environment and be processed by a remote provider, and the payment token/header is also disclosed to that service.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

API Call

bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/doc-writer \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill is described throughout the manifest as a documentation generator, but the tags include health-monitoring and budget, which suggest capabilities outside that purpose. While tags are metadata rather than executable behavior, they still communicate developer intent and can misrepresent the skill's functional scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.