Security audit

Nexus Skills

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Nexus management CLI, but it needs review because one download path can send Nexus credentials to any URL and deletes have no built-in confirmation.

Review before installing. Use a least-privilege Nexus token, avoid admin credentials, and do not run download commands unless the URL is clearly on your Nexus host. Treat delete-component as irreversible and require an explicit human confirmation outside the tool before use. Pin requests to a current safe version if you install it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs use of environment-provided credentials and a Python CLI that performs network operations against a Nexus server, but the skill metadata does not declare corresponding permissions. This creates a transparency and governance gap: operators may invoke a skill with access to sensitive secrets and remote repositories without an explicit permission contract, increasing the chance of unintended credential exposure or destructive actions such as uploads and deletions.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The download command accepts a full arbitrary URL instead of constraining downloads to the configured Nexus instance or known repository asset endpoints. In a skill explicitly described as managing Nexus repositories, this broadens capability into a general network fetch primitive, increasing SSRF-style misuse and enabling operators or upstream agents to retrieve unintended content from internal or external systems.

Context-Inappropriate Capability

High

Confidence: 100% confidence
Finding: The download implementation sends HTTP Basic Auth credentials on every request to whatever URL the caller provides. An attacker who can influence the URL can capture Nexus credentials by directing the tool to an attacker-controlled host, leading to credential compromise and possible unauthorized access to the real Nexus server.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Enabling implicit invocation without trigger constraints allows the skill to be auto-selected in broader contexts than intended, which can cause repository actions to be proposed or executed without clear user intent. Because this skill can search, upload, download, and delete Nexus artifacts, over-broad invocation increases the risk of unintended data exposure or destructive operations from ambiguous prompts.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The command writes downloaded content directly to a path derived from user input or the URL basename, with no confirmation, no safe-directory restriction, and no overwrite protection. In agent-driven or automated use, this can clobber existing files or place attacker-chosen content on disk, which is more dangerous because the skill is meant to perform side-effecting operations from CLI input.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The delete command performs irreversible deletion immediately based solely on a provided component ID, without confirmation, dry-run support, or guardrails. In a repository-management skill, destructive actions are inherently sensitive; accidental invocation, prompt injection into an agent workflow, or misuse of the tool could cause permanent loss of artifacts and disrupt builds or deployments.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manual tells the agent to activate the skill from very broad natural-language phrases without requiring confirmation, scope checks, or repository/target validation. In a skill that can upload artifacts and delete components from Nexus, this increases the chance of unintended invocation and execution of destructive actions from ambiguous user prompts.

Known Vulnerable Dependency: requests==2.25 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: requests==2.25

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

Code: suspicious.env_credential_access
Location: scripts/nexus_cli.py:169