ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenNexum TS

v0.1.0

Contract-driven multi-agent orchestration with ACP. TypeScript CLI for spawning and tracking coding agents via OpenClaw sessions_spawn.

⭐ 0· 95·0 current·0 all-time
by@ayao99315

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ayao99315/opennexum-ts.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "OpenNexum TS" (ayao99315/opennexum-ts) from ClawHub.
Skill page: https://clawhub.ai/ayao99315/opennexum-ts
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install opennexum-ts

ClawHub CLI

Package manager switcher

npx clawhub@latest install opennexum-ts
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the repository contents: this is a pnpm monorepo implementing a 'nexum' CLI, prompt rendering, spawn/status helpers that call the OpenClaw CLI, and optional Telegram notifications. Declared requirements (node >=20, pnpm, openclaw) align with the code which invokes openclaw via execa and is built with pnpm/tsc. No unrelated cloud credentials or binaries are requested.
ℹ
Instruction Scope
SKILL.md and README limit runtime actions to building the repo, running the nexum CLI to generate payloads, calling sessions_spawn via an orchestrator (OpenClaw), and optionally sending Telegram messages if TELEGRAM_BOT_TOKEN/CHAT_ID are set. This stays within the stated purpose. Minor note: Quick Start step 2 tells the user to 'Set env: TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID' although those variables are optional in the README — they are only used for notifications and skipping them preserves core functionality.
✓
Install Mechanism
There is no remote install/spec executed by the platform (instruction-only SKILL.md). Source includes full code files for local build; building requires pnpm and tsc which are declared. No remote downloads or URL installs are present in the skill metadata.
✓
Credentials
The skill declares no required environment credentials. It documents two optional Telegram variables used only for notifications. No unrelated secrets (cloud provider keys, SSH keys, etc.) are requested or required by the skill metadata or instructions.
ℹ
Persistence & Privilege
always:false and normal autonomous invocation settings are used. The CLI will create and update repository-local files (nexum/active-tasks.json, nexum/config.json) and may append callback blocks to AGENTS/CLAUDE files during `nexum init` — that behavior is explicit in the README/CONTRACTs and is coherent with a project CLI, but users should be aware it will modify files inside the project directory.
Assessment
This repo appears to be what it claims: a local TypeScript CLI that builds with pnpm, calls the OpenClaw CLI (so ensure `openclaw` is installed and on PATH), and optionally posts Telegram messages if you supply TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Before using: (1) review the included source (packages/spawn uses execa to call `openclaw` — expected), (2) run builds/tests locally in an isolated workspace or container, (3) note that `nexum init` and CLI commands will create/modify files under the project (nexum/active-tasks.json, config files, and may append to CLAUDE.md/AGENTS.md), and (4) avoid running the CLI from sensitive production directories until you're comfortable with its file-write behavior. If you want extra assurance, run the CLI in a throwaway checkout and inspect generated payloads and the openclaw command arguments before pointing any real orchestrator at them.
✗
packages/core/src/git.ts:66
Shell command execution detected (child_process).
✗
packages/spawn/src/spawn.ts:21
Dynamic code execution detected.
✗
packages/spawn/src/status.ts:19
Dynamic code execution detected.
✗
packages/notify/src/telegram.ts:25
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk976rxehw5n97caqz2319awyhs83txqj
95downloads
0stars
1versions
Updated 4w ago
v0.1.0
MIT-0
@ayao99315
latest
Download

OpenNexum TS

Contract-driven coding agent orchestration via OpenClaw ACP.

When to use

  • Coordinating multiple AI coding agents on a project
  • Running generator/evaluator pairs with automatic retry
  • Tracking parallel ACP sessions with Telegram notifications

Quick Start

  1. pnpm install && pnpm build
  2. Set env: TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID
  3. nexum init — initialize project
  4. Create Contract YAML in docs/nexum/contracts/
  5. nexum spawn <taskId> — get spawn payload
  6. Call sessions_spawn with payload
  7. nexum track <taskId> <sessionKey> — record session
  8. nexum eval <taskId> + spawn evaluator
  9. nexum complete <taskId> <verdict> — process result

Comments

Loading comments...