nexua-ai

Nexus 小程序统一智能助手。整合发布资源/岗位/活动、查询使用报告、智能问答三大功能。当用户说「发布资源/岗位/活动/招聘」「查询 nexus 总结/使用报告/AI使用报告」或询问资源/人、搜索信息时使用此技能。

Key things to check before installing or enabling this skill: - Documentation mismatch: SKILL.md says a JWT token is stored in scripts/token.txt and that token is required for posting, but scripts/nexus_ai.py does not read token.txt or send a token. Ask the author which is correct. If a token is actually required, confirm how it will be provided and stored and inspect scripts/token.txt for sensitive data. - Third‑party data flow: The 'ask' feature posts user queries to https://ai.hydts.cn. If you will send user content (including phone numbers or private text), understand that those queries go to that external service. If privacy of queries is important, do not enable the RAG feature until you verify the provider's privacy/security posture or remove that call. - File path inconsistencies: SKILL.md references a Windows QR image path; the script expects scripts/nexus_qr.png. Confirm that the expected QR image exists where the script expects it, and that no unexpected file reads/writes occur. - Test safely: Run the script in a sandbox or isolated environment first. Use non-sensitive test phone numbers and dummy content to observe network behavior (which endpoints are called and what payloads are sent). Monitor network to verify whether any token or other secret is transmitted unexpectedly. - Ask for clarifications or fixes: Request an updated SKILL.md that matches the code (or updated code that matches the docs). Specifically ask whether an auth token is required and where it should come from, and ask the author to document privacy implications of the RAG endpoint. Overall: the skill appears to implement the advertised features, but the documentation/code inconsistencies and the use of an external RAG service justify caution (suspicious).

Type: OpenClaw Skill Name: nexus-ai Version: 1.0.1 The skill bundle provides a legitimate interface for the Nexus-AI service, allowing users to post job listings, query usage reports, and interact with a RAG-based Q&A system. The Python script (scripts/nexus_ai.py) uses standard libraries to communicate with specific backend endpoints (tcloudbase.com and hydts.cn) and does not exhibit any signs of data exfiltration, unauthorized execution, or obfuscation.