ClawHub
Back to skill

Security audit

NEXUS Grammar Fix

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paid grammar-fixing skill that sends text to a remote NEXUS service, with no local file or shell access.

Install only if you are comfortable sending text to NEXUS for processing and using its payment flow. Avoid submitting secrets, private regulated data, or proprietary drafts unless your policy allows it, and configure payment credentials with clear spending limits or approval expectations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-grammar-fix/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The README says the skill is 'automatically invoked' when a matching task is detected, but it provides no concrete trigger conditions, scope limits, or consent expectations. In a skill that sends user text to a remote paid service, ambiguous auto-invocation increases the chance of unintended data disclosure and unexpected billing.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description does not clearly warn that submitted text will be transmitted to an external host for processing. Because this is a grammar-fixing skill likely to receive arbitrary user writing, omission of an external-transmission warning can lead users or agents to send sensitive drafts, credentials, or proprietary text off-platform without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/grammar-fix \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
92% confidence
Finding
The README explicitly instructs sending user-provided input to an external network endpoint. External transmission is expected for a hosted service, but in the context of an automatically invoked skill, this becomes security-relevant because arbitrary text may be exfiltrated to a third party, potentially including confidential or regulated data.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description and capability description say only "Fix grammar, spelling, and improve writing," which is a very broad natural-language trigger likely to match many ordinary editing requests. The file does not provide narrower trigger phrases, activation boundaries, or negative examples to distinguish when this skill should or should not be invoked.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/grammar-fix \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{
Confidence
91% confidence
Finding
The skill sends arbitrary user-provided text to an external third-party service and includes a payment proof header, creating a real data exfiltration boundary outside the local agent environment. While this is the intended design of a remote SaaS skill rather than obviously malicious behavior, it is still security-relevant because sensitive prompts, proprietary text, or regulated data could be transmitted to an external operator without sufficient minimization or trust validation.

Context-Inappropriate Capability

Low
Confidence
82% confidence
Finding
The file consistently describes a grammar-fixing service, but the tag list includes `health-monitoring` and `budget`, which are not justified by the stated purpose anywhere else in the document. This suggests capability signaling beyond the skill's documented function, even though the code/documented behavior itself does not implement those functions.

Static analysis

No suspicious patterns detected.