registry / pks-nexus-cli / 1.0.27

pks-nexus-cli@1.0.27

Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command execution & Web search. - Browser automation (using Playwright) & Desktop automation. - Git and Docker integration. - M

AI Security Review

scanned 18h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs nexus or nexus run <prompt>.

Impact

A compromised or prompt-injected model/service could read or modify arbitrary user-accessible data and execute commands.

Mechanism

Remote-model-directed local tool execution with automatic approval.

Rationale

This is a high-risk, unsandboxed remote AI-agent capability exposed by an explicit user command, not concrete malware. It should be warned so users can assess the provider and execution model.

Evidence

package.jsondist/cli/repl.jsdist/core/agent/agent.engine.jsdist/core/llm/llm.service.jsdist/core/tools/execute-command.tool.jsdist/core/tools/desktop.tools.js~/.nexus-node/config.jsonarbitrary paths resolved by read_file/write_filedesktop-<timestamp>.pngscreenshot-<timestamp>.png

Network endpoints3

devtoolbox-api.devtoolbox-api.workers.dev/ai/generate

pks-nexus-cli@1.0.27

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code