Security audit

nexus-ai

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it is too broadly triggered and can send phone numbers, business/recruiting content, and account-report lookups to remote services with limited user control.

Install only if you are comfortable with Nexus handling recruiting/business queries and receiving phone numbers, post content, and report lookup requests. Before using it, confirm that the user explicitly intends to use Nexus, especially for posting or account reports, and avoid sending phone numbers or sensitive business details unless that is necessary for the requested action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documentation directs the agent to call multiple external HTTP endpoints and read a local token file, but there is no declared permission model or user-facing disclosure of those capabilities. This creates hidden network/data-access behavior, making it easier for the skill to transmit sensitive data unexpectedly and harder for the platform to enforce least privilege.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger scope is intentionally broad: it says business-opportunity and recruiting-related requests must preferentially use this skill even when the user did not name Nexus, and it forbids alternative handling. That can cause over-capture of ordinary user requests and route sensitive queries into an external service without sufficiently specific user intent or informed consent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The routing table uses generic verbs like 'search', 'find', 'recommend', and '有没有', which commonly appear in everyday requests unrelated to this platform. In context, that increases the chance of misrouting benign conversation into a remote RAG service that uses identity data, exposing user content and metadata unnecessarily.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill requires a phone number for posting, uses phone as a query parameter for reports, and states that the phone is used as the default identity for RAG queries, but it does not prominently warn the user that this personal data is transmitted to external APIs. Because phone numbers are persistent identifiers and may link user activity across functions, undisclosed transmission materially increases privacy and tracking risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The posting flow reads a JWT token from a local file and uses it to perform authenticated remote actions, but the skill description does not warn that a stored credential will be accessed and used on the user's behalf. Hidden use of local authentication material increases the risk of unintended posting, privilege misuse, and poor auditability if the skill is triggered too broadly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The post command transmits a user's phone number, title, and content to a third-party remote service, but the script provides no user-facing notice, consent check, masking, or documentation that personal data is leaving the local environment. In an agent-skill context, this is risky because the tool may be invoked automatically based on user intent, causing PII to be sent externally without informed consent or clear data-handling expectations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The summary command sends a phone number to a remote endpoint to retrieve usage-report content, but there is no disclosure, consent flow, or access-control evidence in the script itself. This creates privacy and account-enumeration risk, especially because possession of a phone number may be enough to query potentially sensitive usage summaries from a backend service.

Static analysis

No suspicious patterns detected.