ClawHub
Back to skill

Security audit

NEXUS Regex Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed hosted regex service, but it can send user text and payment credentials to an external paid API without clearly defined per-use controls.

Install only if you trust NEXUS with the regex prompts, examples, logs, or snippets you submit. Configure the agent to ask before network or paid calls, use sandbox or narrowly scoped payment credentials where possible, and avoid sending secrets, proprietary data, regulated data, or reusable credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The README states the skill is 'automatically invoked' without defining what prompts, scopes, or safeguards trigger that behavior. In an agent ecosystem, ambiguous auto-invocation can cause the skill to be called on broader user inputs than intended, potentially sending sensitive prompt contents to a paid remote service without clear user awareness or consent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill description does not clearly warn users that regex-generation requests are transmitted to a third-party hosted endpoint. This creates a privacy and data-handling risk because users may provide logs, identifiers, or other sensitive strings expecting local processing, while the content is actually sent off-device to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/regex-generator \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{
Confidence
92% confidence
Finding
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/regex-generator \ -H "Content-Type: application/json" \ -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \ -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.