registry / pks-nexus-cli / 1.0.34

pks-nexus-cli@1.0.34

Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command execution & Web search. - Browser automation (using Playwright) & Desktop automation. - Git and Docker integration. - M

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Starting the interactive REPL silently inventories installed and running applications. With a configured tool-capable LLM provider, model-requested host actions are auto-approved, including arbitrary shell execution and unguarded desktop tools.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `nexus` and submits an AI task.

Impact

A malicious or prompt-injected model response can execute commands or access local desktop data; startup inventory is privacy-invasive.

Mechanism

LLM-controlled local tools with automatic approval

Rationale

Source establishes a serious, user-invoked agent capability and an ineffective approval control, but no covert install-time action, persistence, or dedicated exfiltration chain. This warrants a warning rather than a publish block.

Evidence

dist/cli/repl.jsdist/core/system/system-context.service.jsdist/core/agent/agent.engine.jsdist/core/tools/execute-command.tool.jsdist/core/tools/desktop.tools.jsdist/core/config/config.schema.js/Applications/System/Applications~/.nexus-node/config.json

Network endpoints1

devtoolbox-api.devtoolbox-api.workers.dev/ai/generate

pks-nexus-cli@1.0.34

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code