ClawHub
Back to skill

Security audit

NEXUS Email Compose

Security checks for vulnerabilities and agentic risk

Overview

This skill is a paid remote email-drafting helper that clearly discloses its network API, payment proof use, and lack of local filesystem or shell access.

Install only if you are comfortable sending draft content and payment proof information to NEXUS at the disclosed endpoint. Avoid putting secrets, regulated data, or highly sensitive business content in prompts unless NEXUS is an approved provider for that data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-email-compose/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The README says the skill is 'automatically invoked' when a matching task is detected, but does not define the trigger scope or boundaries. For a skill that sends user-provided content to a remote paid service, vague auto-invocation increases the risk of unintended activation, accidental data disclosure, and surprise charges.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/email-compose \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
91% confidence
Finding
The README explicitly instructs clients to send arbitrary input to an external service endpoint, confirming external data transmission. In context this appears to be the intended service model, but it is still a real security/privacy concern because users may submit sensitive draft content, and the document does not pair the transmission with clear consent, minimization, or trust-boundary warnings.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README provides direct examples for posting user input to a third-party HTTPS endpoint but does not warn that message contents will leave the local agent environment. Because this is an email/message composition skill, inputs may include sensitive personal, business, or regulated information, creating a meaningful confidentiality risk if users are not clearly informed.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/email-compose \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{
Confidence
90% confidence
Finding
This skill explicitly sends user-provided input and a payment proof header to an external third-party service endpoint, creating a real data exposure boundary. Although external transmission is inherent to a remote API skill and is openly disclosed, sensitive prompts, business content, or tokens placed into inputs may be unintentionally transmitted off-platform to infrastructure the user does not control.

Context-Inappropriate Capability

Low
Confidence
95% confidence
Finding
The skill consistently presents itself as an email/message composer for drafting professional communications, but the tags include `health-monitoring` and `budget`, which describe unrelated capability areas. These labels imply contexts or use cases not supported anywhere else in the manifest or documentation, creating a purpose-capability mismatch at the intent level.

Static analysis

No suspicious patterns detected.