ClawHub
Back to skill

Security audit

NEXUS Teammate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid remote AI service integration, with no local filesystem or shell access, but it will send prompts and payment proof data to NEXUS.

Install this only if you are comfortable sending matching task inputs to NEXUS over HTTPS and potentially paying per request. Avoid sending secrets, private customer data, or internal source context unless you trust the provider and use a low-scope or sandbox payment proof where possible.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Or manually copy the `SKILL.md` to your OpenClaw skills directory:

```bash
cp SKILL.md ~/.openclaw/skills/nexus-teammate/SKILL.md
```

## Usage
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README states the skill is automatically invoked when a matching task is detected, but does not clearly warn that invocation may send user prompts or task context to a third-party remote service and may incur payment. In an agent environment, this can lead to unintended disclosure of sensitive data and surprise charges because users may not realize local tasks are being routed off-host.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Get the x402/MPP challenge
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/teammate \
  -H "Content-Type: application/json" \
  -d '{"input": "your query here"}'
# Returns 402 + WWW-Authenticate: Payment header
Confidence
92% confidence
Finding
The README instructs clients to POST user-supplied input to an external host, which is a genuine external data transmission path. In the context of an automatically invoked agent skill, this becomes security-relevant because prompts, workflow context, or sensitive data may be sent to a remote paid service without prominent disclosure or scoping limitations.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The skill’s activation description is extremely broad ('data processing, debugging, workflows' and 'context-aware AI partner'), which can cause it to match a wide range of unrelated user requests. In agent ecosystems, overly broad matching increases the chance of unintended invocation and unnecessary transmission of user data to an external paid third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
### API Call

```bash
curl -X POST https://ai-service-hub-15.emergent.host/api/original-services/teammate \
  -H "Content-Type: application/json" \
  -H "X-Payment-Proof: $NEXUS_PAYMENT_PROOF" \
  -d '{
Confidence
95% confidence
Finding
This skill sends user-provided input and a payment-related credential to an external endpoint controlled by a third party. Even though the transmission is documented and uses HTTPS, it still creates a real data exfiltration and secret-handling risk because broad user queries, sensitive context, or payment proof values may be disclosed off-platform.

Static analysis

No suspicious patterns detected.