ClawHub
Back to skill

Security audit

NEXUS Research

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paid remote research skill that sends queries to NEXUS and uses a payment proof, with no local file, shell, or persistence behavior found.

Install only if you trust the NEXUS service with the research text you send and with the payment proof used for requests. Avoid submitting secrets, regulated data, or proprietary material unless your organization allows this provider, and set agent controls so paid remote calls require approval where needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-research/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The statement that the skill is 'automatically invoked' when a matching task is detected does not define trigger conditions, consent requirements, or safety gates. In practice, this ambiguity can cause unreviewed activation of a remote paid service, leading to unintended data disclosure or unexpected charges.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README describes automatic usage and shows POST requests carrying user input to a remote endpoint, but it does not prominently warn that queries are transmitted off-host to a paid external service. This is dangerous because users may submit sensitive prompts under the assumption the skill operates locally, causing privacy loss and potential paid-service abuse.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The README for a 'research assistant' prominently embeds payment-processing and multi-chain cryptocurrency settlement details that are not necessary to explain the core research function. This increases the attack surface and creates a risk that users or agents may authorize payments, handle credentials, or interact with financial infrastructure without clear necessity or security boundaries.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/research \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
93% confidence
Finding
The documented API call explicitly sends arbitrary user-provided input to an external host, which is a genuine external transmission risk in the context of an agent skill. Because the skill is framed as an automatically invoked research assistant, this remote transmission can expose confidential prompts, internal data, or regulated content to a third party.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill is advertised for broad 'research on any topic' use without meaningful activation constraints, which increases the chance it will trigger on common user prompts and send arbitrary user data to a third-party service. In this skill, that broad trigger is more concerning because invocation causes network transmission and potentially payment-backed external processing.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/research \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{"topic": "quantum computing developments 2026"}'
Confidence
95% confidence
Finding
The documented API call sends user-supplied research content and a payment proof header to an external domain, creating a clear data egress path to a third-party service. Even though this appears to be the skill's intended behavior, it is still security-relevant because sensitive prompts, proprietary data, or payment metadata could be transmitted off-platform if users invoke it without strong consent boundaries.

Static analysis

No suspicious patterns detected.