ClawHub
Back to skill

Security audit

NEXUS Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid remote AI orchestration connector, with no local shell or filesystem authority, but users should know their prompts and payment proof are sent to NEXUS.

Install only if you trust NEXUS with the prompts, files snippets, business context, or other text you ask it to orchestrate. Treat the payment proof as sensitive, review charges before paid use, and do not send secrets or regulated data unless you have approved that data sharing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-orchestrator/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The README states the skill is 'automatically invoked' for a 'matching task' without defining trigger conditions, scope, or safeguards. In an agent ecosystem, vague auto-invocation criteria can cause unintended activation and silent routing of user requests to a remote service, increasing the chance of overbroad data exposure or unexpected tool use.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/orchestrator \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
94% confidence
Finding
The README explicitly directs clients to send user-supplied input to an external network endpoint. External transmission is not inherently malicious, but in this skill's context it is security-relevant because the service is an orchestrator that may receive broad, free-form task content, amplifying confidentiality and data-governance risks if used without clear controls.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README instructs users to POST arbitrary input to a third-party orchestration endpoint but does not warn that prompts, task contents, and possibly sensitive data will leave the local environment. This omission is dangerous because users or upstream agents may unknowingly transmit credentials, personal data, or proprietary content to a remote service.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill advertises a very broad capability to 'chain multiple AI services into automated workflows' based on arbitrary user goals, which makes it likely to be auto-selected for many generic prompts. In combination with network access and external data transmission, this increases the chance that sensitive user requests are routed to a third-party service without sufficiently explicit user intent or tight scoping.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/orchestrator \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{"goal": "Research AI safety, summarize findings, translate to Spanish", "max_steps": 5}'
Confidence
96% confidence
Finding
This skill sends user-provided goals and workflow instructions to an external endpoint, and also relies on a payment proof credential in a request header. Even though the transmission is documented and uses HTTPS, it still creates a real data exposure surface: sensitive prompts, business context, or secrets embedded in the input could be disclosed to a third-party service, and broad orchestration increases downstream uncertainty because the remote service may invoke additional AI providers server-side.

Static analysis

No suspicious patterns detected.