NEXUS Document Extract

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:43 PM UTC
• Version: 2.1.0

Overview

This is a coherent paid remote document-extraction skill that clearly sends user-provided input to a NEXUS API, with no local filesystem or shell access requested.

Install only if you are comfortable sending document text to NEXUS for server-side AI processing and with the listed per-request payment model. Avoid submitting secrets, regulated data, or confidential documents unless your organization permits this provider and endpoint.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-document-extract/SKILL.md
```

## Usage

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README states the skill is 'automatically invoked' when a matching task is detected, but gives no trigger boundaries, consent requirements, or examples of what constitutes a match. In a skill that sends user input to a remote paid service, ambiguous auto-invocation increases the risk of unintended data disclosure and unexpected billable network actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to POST document/query input to an external host but does not explicitly warn that sensitive document contents will leave the local environment and be processed by a third-party service. For a document-extraction skill, this is especially risky because inputs may contain confidential, regulated, or proprietary data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/document-extract \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header

• Confidence: 94% confidence
• Finding: The documented API call transmits user-provided input to an external endpoint, which is a real security-relevant behavior for an agent skill. In context, external transmission is the intended function rather than inherently malicious, but it becomes dangerous if users or agents are not clearly informed that potentially sensitive document content will be sent off-host.

External Transmission

Medium

• Category: Data Exfiltration

Content

### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/document-extract \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{

• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to transmit user-provided document contents and a payment proof header to an external third-party service endpoint. This is a real data egress risk because document text may contain sensitive information, and the skill provides no minimization, consent gating, allowlisting rationale, or tenant-local processing option. The context makes this more significant because the skill’s primary purpose is remote AI processing of arbitrary documents, so external transmission is inherent and likely to involve confidential data.

Static analysis

No suspicious patterns detected.