Nex Vault

Secure local contract and document vault for managing all business agreements and important documents with automatic expiration tracking and compliance alert...

This package appears to implement the advertised local document vault, but there are a few mismatches and things to check before installing: - Env var name mismatch: the registry requests VAULT_TELEGRAM_TOKEN and VAULT_TELEGRAM_CHAT_ID, but the code checks NEX_VAULT_TELEGRAM_BOT_TOKEN and NEX_VAULT_TELEGRAM_CHAT_ID. Confirm which names to set (or prefer using the CLI 'config set-telegram-*' commands) so your Telegram alerts actually work and you don't accidentally put secrets in the wrong variable. - Telegram privacy: alerts are sent to the configured Telegram chat via api.telegram.org and will contain document names and messages. Ensure you use a trusted chat (e.g., a private admin chat) and be comfortable with those notifications containing potentially sensitive document metadata. - File handling: when you 'add' a document the tool reads the path you supply and stores that path in the DB rather than necessarily copying the file into ~/.nex-vault. If you want an isolated copy inside the vault, verify whether the tool copies files (review full source) or keep your documents in a controlled directory. - Optional binaries: pdftotext and tesseract are used for extraction but are optional; the registry only declares python3. If you need full parsing, install poppler-utils/pdftotext and tesseract as documented. - Code review: while no network endpoints other than Telegram are present in the reviewed files, if you are concerned about sensitive data you should inspect the rest of the code (some files were truncated in the listing) before trusting it with real contracts. Running setup.sh will create a venv and a CLI in your user home — considered low-risk but run it in an account you control and optionally in a disposable environment first. If these points are acceptable and you verify which env var names the installed CLI expects, the package appears usable for local contract tracking. If you are unsure, ask the publisher for clarification about the env var names and whether the tool copies files into the vault data directory.

Type: OpenClaw Skill Name: nex-vault Version: 1.0.0 The nex-vault skill bundle provides a local document management system with OCR and Telegram notifications, but it contains a critical shell injection vulnerability in `nex-vault.py`. The `cmd_config` function uses `subprocess.run` with `bash -c` to append unsanitized user input (Telegram tokens and chat IDs) directly to the `~/.bashrc` file, which could allow arbitrary command execution if the input is manipulated. While the core logic in `lib/doc_parser.py` and `lib/alerter.py` (which communicates with `api.telegram.org`) aligns with the stated purpose of tracking contracts, the lack of input sanitization in configuration commands poses a significant security risk.