registry / pks-nexus-cli / 1.0.19

pks-nexus-cli@1.0.19

Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command execution & Web search. - Browser automation (using Playwright) & Desktop automation. - Git and Docker integration. - M

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs nexus chat/run and submits a prompt that causes an LLM tool call.

Impact

A compromised or prompt-injected model response can read files, execute commands, modify files, or expose returned data to the configured provider.

Mechanism

Remote-LLM-directed local tool execution with returned tool output.

Rationale

This is a dangerous dual-use AI agent with ineffective interactive approval, not demonstrated malware. No lifecycle abuse or concrete stealth/exfiltration chain was found.

Evidence

package.jsondist/cli/repl.jsdist/core/agent/agent.engine.jsdist/core/tools/execute-command.tool.jsdist/core/tools/read-file.tool.jsdist/core/llm/llm.service.jsdist/core/tools/write-file.tool.js

Network endpoints3

devtoolbox-api.devtoolbox-api.workers.dev/ai/generatetext.pollinations.ai/v1www.bing.com/search

pks-nexus-cli@1.0.19

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code