Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Nex API helper, but it gives an agent direct authenticated ability to change and delete CRM/context-graph data without clear confirmation safeguards.
Install only if you want your agent to access Nex with the scopes you grant. Prefer a narrowly scoped API key, avoid schema/delete scopes unless needed, require manual confirmation before any DELETE/PATCH/PUT/POST that changes important data, and do not submit confidential transcripts or regulated data without organizational approval.
Delete an object definition and all its records.
**Endpoint**: `DELETE /v1/objects/{slug}`
**Scope**: `object.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/objects/project",
"timeout": 120
}
```Remove an attribute from an object type.
**Endpoint**: `DELETE /v1/objects/{slug}/attributes/{attr_id}`
**Scope**: `object.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/objects/project/attributes/456",
"timeout": 120
}
```Permanently delete a record.
**Endpoint**: `DELETE /v1/records/{record_id}`
**Scope**: `record.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/records/789",
"timeout": 120
}
```Remove a relationship definition.
**Endpoint**: `DELETE /v1/relationships/{id}`
**Scope**: `relationship.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/relationships/789",
"timeout": 120
}
```Remove a relationship between two records.
**Endpoint**: `DELETE /v1/records/{record_id}/relationships/{relationship_id}`
**Scope**: `relationship.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/records/1001/relationships/5001",
"timeout": 120
}
```Delete a list definition.
**Endpoint**: `DELETE /v1/lists/{id}`
**Scope**: `object.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/lists/300",
"timeout": 120
}
```Remove a record from a list.
**Endpoint**: `DELETE /v1/lists/{id}/records/{record_id}`
**Scope**: `record.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/lists/300/records/4001",
"timeout": 120
}
```Archive a task (soft delete).
**Endpoint**: `DELETE /v1/tasks/{task_id}`
**Scope**: `task.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/tasks/800",
"timeout": 120
}
```Archive a note (soft delete).
**Endpoint**: `DELETE /v1/notes/{note_id}`
**Scope**: `note.write`
```json```json
{
"tool": "exec",
"command": "bash {baseDir}/scripts/nex-api.sh DELETE /v1/notes/900",
"timeout": 120
}
```1. Log in to [Nex](https://app.nex.ai) 2. Go to **Settings > Developer** 3. Create a new API key with the following scopes: - `record.read` - For querying context - `record.write` - For processing text
;;
esac
# --- Build curl arguments ---
CURL_ARGS=(
-s
-w '\n%{http_code}'No suspicious patterns detected.