NEXUS Multi Model

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:35 PM UTC
• Version: 2.1.0

Overview

This skill clearly describes a paid remote AI-routing service and does not include hidden local access, persistence, or executable payloads.

Install only if you are comfortable sending prompt contents and payment proof material to the NEXUS hosted service. Configure your agent to ask before sending sensitive prompts or making paid requests, and prefer sandbox testing until you trust the provider and payment flow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-multi-model/SKILL.md
```

## Usage

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README states the skill is 'automatically invoked ... when a matching task is detected' without defining strict routing conditions or user-consent boundaries. In an agent setting, ambiguous auto-invocation can cause sensitive prompts to be routed to this remote service unexpectedly, increasing the chance of unintended data disclosure or paid requests.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README describes sending user input to a hosted API but does not clearly warn that prompts leave the local environment and are processed by a third-party service. For agent skills, omission of this disclosure is dangerous because users or operators may unknowingly expose secrets, personal data, or proprietary information to an external endpoint.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/multi-model \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header

• Confidence: 93% confidence
• Finding: The documented behavior explicitly sends the user's input in an HTTP POST to an external domain. External transmission is not inherently malicious, but in a skill that may be auto-invoked it becomes security-relevant because prompt contents could include sensitive data, and the README does not pair this with strong consent, privacy, or data-handling warnings.

External Transmission

Medium

• Category: Data Exfiltration

Content

### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/multi-model \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{"prompt": "Explain machine learning to a beginner", "optimize_for": "balanced"}'

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to transmit user prompts and a payment credential/header to a third-party service endpoint. This creates a real data exfiltration and secret-disclosure risk because arbitrary user input, and potentially reusable payment proof material, leave the local trust boundary and are sent to an external operator-controlled service.

Static analysis

No suspicious patterns detected.