NEXUS Image Analysis

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:35 PM UTC
• Version: 2.1.0

Overview

This is a disclosed paid remote image-analysis skill that sends user input to a NEXUS API, with no local shell, filesystem, persistence, or hidden behavior found.

Install only if you trust NEXUS to process submitted image-analysis inputs and payment proofs. Avoid sending secrets, private images, regulated data, or sensitive account information unless you are comfortable with the provider's handling of that data and the per-request cost.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-image-analysis/SKILL.md
```

## Usage

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README states the skill is automatically invoked and demonstrates sending user-provided input to a remote endpoint, while also documenting per-request charges and payment flows. However, it does not clearly warn that agent/user data may be transmitted off-host and that automatic invocation can incur costs, creating a meaningful consent, privacy, and billing risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/image-analysis \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header

• Confidence: 93% confidence
• Finding: The README explicitly instructs clients to POST user input to an external hosted service, confirming off-system transmission of potentially sensitive data. In the context of an auto-invoked agent skill, this is more dangerous because users may not realize their prompts or related content are being sent to a third party for processing.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill is consistently described elsewhere as an image-analysis service focused on understanding images, but the input field is documented as "The input text or query." This is not merely incomplete wording: it actively describes a different modality than the capability claimed by the skill and can mislead developers about what data the service expects.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation guidance is so broad that an agent may invoke this remote skill for loosely related requests, causing unnecessary transmission of user data to a third-party service and potentially triggering unintended payments. In an agent ecosystem, vague invocation criteria can expand the skill's effective access to sensitive prompts or data beyond what users reasonably expect.

External Transmission

Medium

• Category: Data Exfiltration

Content

### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/image-analysis \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{

• Confidence: 95% confidence
• Finding: The skill explicitly sends input data and a payment proof header to an external host. Even though this is core to the skill's function and disclosed in the documentation, it is still a real data-exfiltration boundary: sensitive user content, metadata, and payment-related identifiers may leave the local trust domain and be processed by a third party.

Static analysis

No suspicious patterns detected.