ClawHub
Back to skill

Security audit

NEXUS Llm Gateway

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent paid LLM gateway, but it can send prompts and payment credentials to a remote service under vague auto-invocation conditions.

Review this before installing if you handle confidential prompts or do not want an agent making paid remote LLM calls automatically. Use sandbox or short-lived/limited payment credentials where possible, avoid sending secrets or regulated data, and confirm your agent's invocation and spending controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-llm-gateway/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The README states the skill is 'automatically invoked' when a 'matching task is detected' but never defines what matching means or what data may be sent when that happens. In an agent ecosystem, vague auto-invocation criteria can cause unexpected triggering and unintended disclosure of user prompts to an external service.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README provides example requests that send arbitrary user input to a third-party host but does not warn users that prompts may contain sensitive data and will leave the local environment. This creates a real privacy and security risk because operators may enable or use the skill without understanding that confidential prompts are transmitted externally.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/llm-gateway \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
95% confidence
Finding
The example explicitly transmits user-supplied input to an external domain, which is a genuine data egress behavior. In the context of an auto-invoked agent skill, this is more dangerous because users may not realize their prompts are being sent off-host to a remote LLM gateway and potentially onward to multiple model providers.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/llm-gateway \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{"prompt": "Write a Python function to sort a list", "tier": "auto", "task_type": "code"}'
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to transmit user-supplied prompts and a payment credential (`X-Payment-Proof`) to an external third-party endpoint. This is a real data-exposure and credential-sharing behavior: even if it is the advertised purpose of the skill, it creates privacy and financial risk because sensitive input and payment proof leave the local trust boundary and are processed by a remote service.

Static analysis

No suspicious patterns detected.