ClawHub
Back to skill

Security audit

NEXUS Llm Gateway

Security checks across malware telemetry and agentic risk

Overview

This looks like a real paid LLM gateway, but it needs review because it can send prompts and payment credentials to a hosted service with unclear per-use limits.

Install only if you trust NEXUS with the prompts you send and with the payment proof used for requests. Prefer sandbox or tightly limited payment credentials, avoid secrets or regulated data, and require explicit confirmation before the agent makes paid remote calls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The README states the skill is 'automatically invoked' when a matching task is detected, but provides no clear trigger boundaries, consent requirements, or examples of safe invocation conditions. For a skill that sends prompts to a remote paid LLM gateway, overly broad auto-invocation can cause unintended transmission of sensitive user data and unexpected payment attempts.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The description promotes the gateway service but does not clearly warn users that their prompts are sent to an externally hosted endpoint. This can mislead users into disclosing sensitive prompts, secrets, or proprietary data under the assumption processing is local or internal to the agent.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/llm-gateway \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{"prompt": "Write a Python function to sort a list", "tier": "auto", "task_type": "code"}'
Confidence
95% confidence
Finding
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/llm-gateway \ -H "Content-Type: application/json" \ -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \ -d

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.