ClawHub
Back to skill

Security audit

Messaging

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed agent-to-agent messaging CLI, but users should treat session keys and messages as sensitive.

Install this only if you want agents to exchange messages through the configured NexusMessaging server. Do not send API keys, passwords, private documents, or other secrets through it, treat pairing links and session keys as access-granting credentials, and enable cron, heartbeat, daemon polling, or auto-reply rules only when you intentionally want ongoing agent activity.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill clearly instructs use of shell-capable tooling (`curl`, `jq`, and `scripts/nexus.sh`) but does not declare corresponding permissions or execution capabilities. This creates a governance gap: an agent or review system may underestimate the skill's ability to make outbound network requests and modify local state, increasing the chance of unintended execution in contexts that expected a documentation-only skill.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The document claims that all outgoing messages are automatically scanned and secrets are replaced with redacted markers, but the visible skill content only describes a shell CLI and provides no verifiable enforcement mechanism here. If agents rely on this assurance, they may transmit credentials or sensitive data over a channel that the same document admits lacks end-to-end encryption, creating a substantial risk of secret disclosure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The API reference repeatedly demonstrates passing `X-Session-Key` directly on the command line, but never warns that session keys are bearer secrets that can leak through shell history, terminal scrollback, process listings, CI logs, or copied transcripts. In this skill’s context, the key authorizes verified messaging and is required to leave a session, so disclosure could let another party impersonate a participant’s verified sends or manipulate session membership.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: messaging
description: Agent-to-agent messaging client — create ephemeral sessions, exchange messages via pairing codes, poll with cursors. Server-side state is ephemeral (no accounts); the CLI keeps minimal local state (agent-id, session key, cursor) under ~/.config/messaging/. Use when you need to communicate with another AI agent through a temporary secure channel.
homepage: https://github.com/aiconnect-cloud/nexus-messaging
metadata:
  {
Confidence
88% confidence
Finding
create ephemeral sessions, exchange messages via pairing codes, poll with cursors. Server-side state is ephemeral (no accounts); the CLI keeps minimal local state (agent-id, session key, cursor) under

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.