Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Nex API helper, but it gives an agent direct authenticated ability to change and delete CRM/context-graph data without clear confirmation safeguards.
Install only if you want your agent to access Nex with the scopes you grant. Prefer a narrowly scoped API key, avoid schema/delete scopes unless needed, require manual confirmation before any DELETE/PATCH/PUT/POST that changes important data, and do not submit confidential transcripts or regulated data without organizational approval.
The declared purpose suggests a contextual CRM helper, but the skill actually documents a broad authenticated API client capable of creating, modifying, and deleting many remote resources. This mismatch increases the chance that an agent or user triggers destructive or high-privilege behavior under the assumption the skill is mainly read/query oriented.
This endpoint deletes an object definition and all of its records, making it an inherently destructive capability. In an agent skill context, exposing such operations without strong guardrails creates a real risk of accidental or prompt-induced data loss against the connected workspace.
Delete an object definition and all its records.
Endpoint: DELETE /v1/objects/{slug}
Scope: object.write
The example provides a ready-to-run shell command for deleting an object, which lowers the barrier for accidental or manipulated execution. Because the wrapper is authenticated with the user's API key, misuse directly affects real production data rather than a sandbox.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/objects/project",
"timeout": 120
}
Deleting attribute definitions can break schemas, automation, and downstream consumers, and may effectively orphan or invalidate stored data. The risk is elevated in an agent setting because an LLM may infer or hallucinate identifiers and still attempt a destructive call.
Remove an attribute from an object type.
Endpoint: DELETE /v1/objects/{slug}/attributes/{attr_id}
Scope: object.write
The concrete command example makes destructive schema changes operationally trivial. If selected by an agent due to ambiguous prompts, it could remove important fields and disrupt records or integrations immediately.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/objects/project/attributes/456",
"timeout": 120
}
Permanent record deletion is a sensitive capability with clear integrity and availability implications. In a natural-language-driven environment, unintended deletions can result from prompt injection, misunderstanding, or overly broad automation logic.
Permanently delete a record.
Endpoint: DELETE /v1/records/{record_id}
Scope: record.write
The example command demonstrates immediate deletion of a specific record using authenticated shell execution. This is dangerous because it normalizes direct destructive execution from prompt-driven workflows without a compensating verification step.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/records/789",
"timeout": 120
}
Removing relationship definitions can alter data semantics and break graph-based reasoning or application logic. While less catastrophic than mass record deletion, it can still cause substantial integrity issues in organizational context data.
Remove a relationship definition.
Endpoint: DELETE /v1/relationships/{id}
Scope: relationship.write
The runnable deletion example reduces friction for modifying graph structure in production. In context-graph systems, deleting relationships can silently degrade later AI answers and business workflows.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/relationships/789",
"timeout": 120
}
Deleting relationship instances can change business context and history in ways that affect downstream decisions and recommendations. Because the skill is positioned as a context assistant, these operations can silently distort the graph the agent relies on.
Remove a relationship between two records.
Endpoint: DELETE /v1/records/{record_id}/relationships/{relationship_id}
Scope: relationship.write
This example turns relationship removal into a copy-paste shell action against authenticated infrastructure. That increases risk of accidental use or misuse by an agent reacting to adversarial or ambiguous instructions.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/records/1001/relationships/5001",
"timeout": 120
}
Deleting list definitions can disrupt workflows, segmentation, and access patterns. Although not always irreversible at the platform level, it is still a destructive administrative action exposed through a prompt-driven shell interface.
Delete a list definition.
Endpoint: DELETE /v1/lists/{id}
Scope: object.write
The skill includes a concrete shell command for deleting a list, making the action easy to trigger. In an agent environment, such examples can be reproduced without adequate human scrutiny.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/lists/300",
"timeout": 120
}
Removing records from lists affects targeting, reporting, and operational state, and may be performed unintentionally if list or record IDs are mishandled. The capability is less severe than permanent deletion but still changes remote state in a potentially business-impacting way.
Remove a record from a list.
Endpoint: DELETE /v1/lists/{id}/records/{record_id}
Scope: record.write
The ready-made command enables direct mutation of list membership using shell execution and an API key. This creates risk of accidental data-management changes when the skill is invoked broadly or prompted imprecisely.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/lists/300/records/4001",
"timeout": 120
}
Task deletion is described as archival rather than permanent destruction, so the impact is lower than other delete endpoints. However, it still permits state-changing actions that can suppress reminders or operational follow-up if triggered unintentionally.
Archive a task (soft delete).
Endpoint: DELETE /v1/tasks/{task_id}
Scope: task.write
The concrete archive command makes it easy for an agent to change task state without verifying business intent. Even soft deletes can disrupt workflows and accountability if executed in error.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/tasks/800",
"timeout": 120
}
Note deletion is a softer-risk operation than schema or record deletion, but it still changes potentially important organizational memory. In a context-management product, removing notes can degrade historical traceability and AI recall.
Archive a note (soft delete).
Endpoint: DELETE /v1/notes/{note_id}
Scope: note.write
The example demonstrates direct authenticated archival of a note, which can be misused or triggered accidentally by natural-language workflows. While the action is likely reversible, it still affects integrity of the context corpus.
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/notes/900",
"timeout": 120
}
The README explicitly states that the skill builds a context graph from conversations and shares organizational context with agents, but it does not warn users about the privacy, confidentiality, or third-party data-sharing implications. In a skill designed to ingest transcripts and business relationship data, that omission can cause users to send sensitive personal or corporate information to an external service without informed consent or appropriate governance review.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
1. Log in to [Nex](https://app.nex.ai)
2. Go to **Settings > Developer**
3. Create a new API key with the following scopes:
- `record.read` - For querying context
- `record.write` - For processing text
The skill exposes shell-based execution patterns throughout the document but does not declare any explicit tool scope such as allowed-tools or permissions. That weakens platform-level containment and makes it easier for the skill to be invoked with broader execution capability than users or reviewers may expect.
The description is broad enough to match many generic requests involving context, records, notes, contacts, or insights. Over-broad activation increases the risk that an agent selects this skill unnecessarily, exposing sensitive organizational data or performing unintended remote actions.
The ProcessText feature encourages uploading conversations and meeting notes to a remote API without an explicit consent, sensitivity, or data-handling gate. In practice this can cause an agent to transmit confidential internal discussions or personal data to the SaaS backend without the user fully appreciating that external disclosure is happening.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
;;
esac
# --- Build curl arguments ---
CURL_ARGS=(
-s
-w '\n%{http_code}'
No suspicious patterns detected.