Nexus Edge Deployer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 2.1.1

Overview

The skill is a documentation-only VPS AI deployment helper, but it under-discloses safeguards around chargeable cloud provisioning and conflicts with its own local-only privacy claim.

Review this carefully before installing. Only use it with scoped Hetzner credentials, require an explicit plan and confirmation before any provisioning, and disable or separately approve any cloud inference fallback if workloads may contain private, regulated, or client data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:21

Finding

Uncontrolled Cloud Inference Fallback Contradicts Local-Only Data Guarantee

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21 and 38
Vulnerability Type: Privacy-sensitive data disclosure through an unspecified cloud inference fallback
Risk Level: Medium

Relevant Code Snippet:

markdown

- GDPR/HIPAA compliance via local inference (no data leaves server)

markdown

- Maintain cloud API fallback for quality-critical tasks

Technical Analysis

The Skill promises that local inference prevents data from leaving the server, but it also instructs operators to maintain a cloud API fallback for quality-critical tasks. Invoking such a fallback can transmit inference inputs—including prompts, client personas, business information, or regulated records—to an external service.

The Skill does not specify an approved cloud provider, an explicit user-consent requirement, criteria for activating the fallback, sensitive-data classification or redaction, regulated-workload restrictions, retention controls, processing terms, or audit requirements. Consequently, the fallback may exceed the minimum network privileges necessary for a deployment represented as local-only.

This is a configuration and workflow security weakness rather than evidence of an implemented exfiltration payload. The project contains only documentation, and no executable mechanism that automatically sends data was found.

Attack Path

1. A client selects local inference based on the statement that no data leaves the server.
2. The deployed agent receives a prompt containing confidential, personal, or regulated information.
3. The request is classified as quality-critical, either manually or by downstream implementation logic.
4. The cloud API fallback is activated without a mandatory consent or sanitization gate.
5. The full request or associated context is transmitted to an unspecified external inference provider.
6. The external provider may process, log, or retain the information under controls ...[truncated 730 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the cloud fallback from deployments advertised as local-only.
• If fallback is required, make it explicitly opt-in per tenant and clearly state that selected data may leave the server.
• Require separate, informed authorization before transmitting any request externally; do not infer consent merely from use of the Skill.
• Define an allowlist of approved providers and endpoints rather than permitting an unspecified cloud API.
• Prohibit cloud fallback for regulated or confidential workloads unless an appropriate processing agreement and compliance review are in place.
• Apply data classification, minimization, and redaction before transmission. Exclude credentials, identifiers, health information, proprietary context, and unnecessary conversation history.
• Enforce transport encryption, secure credential storage, least-privilege API keys, provider retention restrictions, and tenant isolation.
• Record fallback activation, destination, reason, data classification, and authorization in privacy-preserving audit logs.
• Provide a strict configuration mode that technically blocks all outbound inference traffic.
• Replace the unconditional privacy statement with documentation accurately describing the processing boundary and every condition under which data may leave the server.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly describes provisioning VPS infrastructure via the Hetzner API with cloud-init, which can trigger real infrastructure creation, configuration changes, and recurring charges. Because the skill does not prominently require explicit user confirmation, cost disclosure, or a dry-run/simulation step before these actions, an agent following it could make unintended external changes with financial and operational impact.

Content

No source excerpt is available for this finding.