Nexus Agent Framework 🔮

• Outcome: Review
• Latest audit: May 28, 2026 · 1:26 PM UTC
• Version: 2.0.0

Overview

The skill includes its advertised local indexing framework, but also bundles unrelated code-rewrite scripts and a preconfigured Telegram reporter that could expose private workspace summaries if run.

Review before installing. Remove or ignore fix.py and fix_final.py, delete unrelated nested skills you do not intend to use, set Telegram off or replace the chat ID before running daily-observatory-lite, and do not enable cron until you have checked exactly which local files will be read and where reports will be sent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises shell execution and file read/write behavior but does not declare permissions or clearly bound those capabilities. In an agent framework, undeclared access weakens user consent and platform enforcement, making it easier for the skill to read or modify workspace content unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is limited to indexing, idea generation, and relationship analysis, but the observed behavior includes unrelated file modification, reading personal workspace files, invoking external agent/system commands, creating reports, and sending outbound Telegram messages. This mismatch is dangerous because users may grant trust based on the description while the skill performs materially broader actions that can expose data, alter local content, or trigger external communications.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill claims a strong security/privacy posture, but the instruction to log all inputs creates a direct contradiction: untrusted and potentially sensitive user content is retained by default. In an agent framework that handles personal conversations and memory files, blanket input logging increases the chance of unnecessary collection, secondary exposure, and accidental reuse of private data.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file is a code-rewriting script that unconditionally overwrites Python source files in another skill directory using hard-coded absolute paths. That behavior exceeds the stated framework purpose and creates a supply-chain style risk: anyone running it would silently modify local skill code, potentially inserting backdoors, breaking integrity, or sabotaging other components.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The helper function accepts an arbitrary path and writes attacker-controlled content to disk, while the script uses it to overwrite files in a separate skill tree. Even though the current calls use fixed paths, the capability itself is unjustified for the described skill and enables unauthorized local code tampering if reused or modified.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This script is not merely framework logic; it unconditionally writes Python source files into a different skill directory using hard-coded absolute paths. That creates an unauthorized code-modification capability inconsistent with the declared purpose, and in an agent ecosystem this can be used to tamper with adjacent components or persist altered behavior without operator awareness.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The hard-coded target path points to another project area and bypasses any normal boundary checks, making the behavior effectively a built-in arbitrary file overwrite within the local environment. If this script is run with sufficient permissions, it can silently replace operational code in another skill, leading to integrity compromise, persistence, or execution of attacker-controlled logic on later runs.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code unconditionally reads a fixed file from the user's home workspace (`~/.openclaw/workspace-frontdesk/EMOJI-JOURNAL.md`) without any visible permission check, scope restriction, or user consent flow. Even though it only reads one specific file, that file is a personal journal containing sensitive emotional and behavioral data, so this creates an unjustified privacy-sensitive data access path for a broadly described agent skill.

Description-Behavior Mismatch

Medium

• Confidence: 71% confidence
• Finding: The file adds outbound message-delivery capability that is not obviously aligned with the stated skill scope of knowledge indexing, creative suggestions, and relationship systems. Capability drift matters in agent skills because an unrelated exfiltration or notification channel can be abused to transmit data or trigger actions outside expected user intent.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: Invoking an external agent CLI to deliver messages introduces an unnecessary privileged integration point that is not justified by the described framework purpose. In an agent setting, external delivery mechanisms can become covert channels for sending data off-system, especially when their behavior is defined outside the current codebase.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs persistent storage of a user's emotional state in `memory/YYYY-MM-DD.md` without any notice, consent, retention limit, or access controls. Persisting inferred mood data creates privacy risk because it builds a behavioral profile that may be sensitive and could later influence system behavior or be exposed through memory access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly authorizes reading and modifying persistent memory/state files during heartbeat, including summarizing daily memory into MEMORY.md and updating heartbeat-state.json, without requiring user consent, scope limits, or safeguards for sensitive content. In an agent framework, autonomous background writes to memory can corrupt records, retain sensitive user data longer than intended, or cause privacy-impacting persistence and cross-task contamination.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that it automatically scans workspace markdown files and generates index and relation outputs, but it does not clearly warn users that this entails broad file reads and persistent writes. Automatic processing of all markdown content can capture sensitive notes or secrets stored in documentation files and write derived data to JSON outputs that may be committed or shared later.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example instructs the agent to base64-encode a local image and send it to OpenRouter, but it does not warn that image contents may contain sensitive data and will be transmitted to a third-party service. In an agent framework, this creates a real risk of unintended exfiltration of screenshots, documents, receipts, forms, or UI captures that may include secrets or personal information.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The instructions reference use of $OPENROUTER_API_KEY but provide no guidance on secure storage, redaction, or avoiding accidental disclosure in logs, screenshots, or committed files. While not an immediate secret leak by itself, normalizing direct credential use without safeguards increases the chance of operational credential exposure.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The document promotes automatic scanning of local log files and report generation without warning users that potentially sensitive content in memory/ logs will be processed and copied into output reports. In an agent-skill context, this increases the chance of inadvertent privacy exposure, especially if logs contain secrets, internal notes, or personal data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The cron instructions encourage unattended recurring execution that continuously processes local log data, but the documentation does not warn that this will run persistently in the background or keep generating derived outputs. In practice, scheduled processing can repeatedly expose or accumulate sensitive information in report files and logs without ongoing user awareness.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The document defines an automatic trigger on every log write, which is overly broad and can cause indexing to run on routine or attacker-influenced file updates. In an agent framework, this can create unintended invocation chains, resource exhaustion, or processing of untrusted content without clear gating.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The real-time trigger for modifications to MEMORY.md is underspecified, so any change may initiate indexing without distinguishing trusted maintenance updates from arbitrary content changes. This ambiguity increases the chance of accidental reprocessing loops, unintended skill activation, or abuse through crafted edits to a monitored file.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script performs immediate writes to hard-coded local paths with no warning, confirmation, backup, or rollback. This makes accidental or deceptive execution dangerous because it can silently alter local code and impair auditability, even if the payload is not overtly malicious.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs destructive file writes with no prompt, dry-run mode, backup, or confirmation, so simply executing it causes immediate source-code changes. In the context of agent skills, this is especially risky because silent modification of Python files can alter future agent behavior in ways that are difficult to detect or attribute.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises automatic health checks, mood tracking, task monitoring, and scheduled Telegram delivery, but does not clearly warn users up front that potentially sensitive operational and behavioral data will be pushed externally on a schedule. This creates a privacy and data-exfiltration risk because users may install or enable it without realizing it performs recurring outbound notifications containing internal status information.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This skill reads a user journal file from a home-directory workspace with no user-facing warning, consent prompt, or transparency mechanism. Because journals can contain highly sensitive personal information, silent access materially increases privacy risk and makes misuse or unexpected data processing harder for the user to detect.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill transmits a report containing emotion-trend information and possibly other sensitive behavioral data to Telegram without any disclosure, consent flow, or redaction in this file. External messaging services expand the exposure surface, and sending personal-state data over a third-party channel can create privacy, compliance, and unintended disclosure risks if chat IDs or recipients are misconfigured.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The module can send outbound messages through a subprocess without any visible user confirmation, authorization flow, or policy guardrails. In an agent environment, silent external communication increases the risk of unauthorized notifications or data leakage because users may not realize the skill can contact external recipients.

Static analysis

No suspicious patterns detected.