T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Mandatory Skill Routing Overrides Normal Agent Tool Selection
- Content
View full analysis
- Remediation
View remediation
Security audit
nexus-ai
Security checks for vulnerabilities and agentic risk
Overview
This Nexus skill mostly does what it says, but it overbroadly routes ordinary business or recruiting requests to external services and can send phone numbers, queries, and posting content without clear user confirmation.
Review before installing. Use this only if you want Nexus to handle business and recruiting workflows, and require explicit confirmation before sending phone numbers, free-form queries, or publishing content. Treat posted job, recruiting, investment, and collaboration text as potentially visible or retained by the Nexus service, and avoid confidential information unless you trust that service's handling and logging practices.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/nexus_ai.py:76- Finding
Sensitive Personal and Business Data Is Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are overly broad and include common business and recruiting terms, causing the skill to intercept many ordinary conversations that may not require Nexus at all. Because the skill then routes users into external API flows, broad activation materially raises the risk of unintended execution and unnecessary sharing of user data.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The routing policy mandates this skill for all hiring or business-opportunity requests and explicitly forbids alternative handling, even when a safer or more privacy-preserving path may exist. This hard override increases the blast radius of accidental invocation and can force user data into third-party services without meaningful consent or contextual validation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs collection of a user's phone number and transmission to external APIs, but provides no explicit privacy notice, consent mechanism, retention disclosure, or minimization guidance. Phone numbers are sensitive identifiers, and sending them to third-party endpoints without clear warning can cause privacy violations, misassociation of accounts, and regulatory exposure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill specifies mandatory use of external HTTP endpoints and script execution, but does not declare any tool scope, permissions, or allowed-tools boundaries. This creates a least-privilege and transparency gap: an agent may invoke networked behavior the platform or reviewer did not explicitly approve, increasing the chance of unintended data egress.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Generic phrases such as 'ask,' 'check,' and 'help me find' are too vague to safely trigger a networked skill, especially in multilingual everyday conversations. In this skill's context, vague triggers are more dangerous because activation can send user queries to an external RAG service tied to identity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The ask flow sends both the user's query and an identity value, defaulting to the user's phone number, to an external RAG endpoint without warning the user. This is dangerous because free-form queries may contain sensitive personal or business information, and pairing them with a stable identifier increases tracking and privacy risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The note states that the phone number must be a real and valid Chinese mainland number. This is a locale-specific restriction presented as a mandatory rule, but the file does not offer alternatives, opt-in, or explain why the limitation is required for a region-specific compliance or service constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring presents the skill only in Chinese, and the rest of the user-facing help/output follows the same pattern. This imposes a language choice on users without any opt-in, alternative locale, or documented region-specific justification, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The argparse description, subcommand help, and argument help strings are all written only in Chinese. Because this is the primary CLI interface, it forces a specific language on all users and does not offer any language choice or explicit region-specific constraint.
- Content