ClawHub
Back to skill

Security audit

NEXUS Grammar Fix

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed paid grammar-fixing API skill that sends submitted text to NEXUS, with no hidden code, local file access, shell access, or persistence found.

Install only if you are comfortable sending text to the NEXUS service and using its payment flow. Avoid submitting secrets, credentials, regulated data, private contracts, or sensitive drafts unless NEXUS's privacy and retention terms meet your needs, and monitor use if NEXUS_PAYMENT_PROOF is configured because requests are priced per call.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The README states the skill is 'automatically invoked' when a matching task is detected, but it does not define what counts as a match or what data may be sent when triggered. For a skill that calls a remote paid endpoint, ambiguous trigger boundaries can cause unintended activation and disclosure of user text to an external service without clear user awareness.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill description and usage text do not clearly warn that submitted text is transmitted to a third-party network service. Because this is a grammar-fixing skill, users may submit sensitive drafts, credentials, personal data, or proprietary content, making the lack of an explicit disclosure materially risky.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/grammar-fix \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
95% confidence
Finding
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/grammar-fix \ -H "Content-Type: application/json" \ -d '{"input": "your query here"}' # Returns 402 + WWW-Authenticate: P

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.