Cnexus2.0

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.10.1

Overview

This skill describes a local second-brain app, but installing it requires cloning and running mutable external code that is not included in the reviewed artifact.

Install only if you are comfortable trusting the external GitHub repository or OpenClaw package at install time. Prefer a pinned commit or signed release, review the runtime before running it, and back up any CNexus memory file before using the clear-memory function.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:25

Finding

Unpinned Remote Runtime Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–27 and 48–51
Vulnerability Type: Remote Payload Retrieval and Execution
Risk Level: Medium

The supplied artifact does not contain the advertised runtime. Instead, it directs users to retrieve and execute mutable content from external sources without pinning a version or verifying its integrity.

Complete vulnerable code snippets:

bash

git clone https://github.com/plusunm/CNexus2.0.git
cd CNexus2.0
python app_v2.py

bash

openclaw skills install @plusunm/cnexus-cognitive-core

The surrounding documentation also states:

text

完整运行时请克隆上方 GitHub 仓库。

This instructs the user to clone the external GitHub repository to obtain the complete runtime.

Technical Analysis

The git clone command retrieves the repository's mutable default branch and then directly executes app_v2.py. No audited commit hash, immutable release artifact, cryptographic checksum, or signature is specified. Consequently, the code executed by a user can differ from the code that existed when this Skill was reviewed.

The alternative OpenClaw installation command also omits an exact package version and integrity verification. Its effective contents therefore cannot be established from the supplied artifact.

This is best classified as remote payload retrieval and execution because the Skill explicitly establishes a download-and-execute path whose effective payload may change after review. The current artifact does not establish that the upstream content is malicious; the vulnerability is the absence of controls binding execution to a reviewed payload.

Attack Path

1. An attacker compromises the upstream GitHub repository, its maintainer account, the OpenClaw publisher account, or the relevant distribution infrastructure.
2. The attacker changes the default branch or publishes a modified package containing malicious runtime logic.
3. A user ...[truncated 1163 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete runtime in the reviewed Skill artifact so that all executable behavior can be audited together.
2. Pin the Git source to a specific audited commit hash rather than cloning and executing the mutable default branch.
3. Pin the OpenClaw package to an exact audited version, if the package manager supports version constraints.
4. Distribute signed, immutable release artifacts and document signature verification before installation.
5. Publish SHA-256 or stronger cryptographic digests through a separately protected channel and require verification before execution.
6. Add a lockfile or manifest recording exact dependency and runtime versions.
7. Document the runtime's expected filesystem access, network connections, environment-variable use, and handling of persisted personal data.
8. Run the application with least privilege, bind its HTTP service only to the intended local interface, and isolate it from unrelated user files where practical.
9. Establish a repeatable release process in which each pinned version is independently reviewed before documentation is updated to reference it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly advertises one-click and API-based memory clearing, but the description does not warn users that persisted cognitive state may be permanently deleted. In a 'personal second brain' context, stored memories and notes are the core asset, so omission of an irreversibility warning increases the risk of accidental destructive use or unsafe automation invoking the clear endpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Natural-language policy violations include forcing a specific language without user opt-in. The descriptive content and headings are primarily in Chinese, and the file does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.