Nia

• Analyzed: May 12, 2026, 3:14 AM
• Findings: 1
• Version: 1.0.3
• Hash: 1c0c119b04e0e257eed644d9f27e9448e9837afae938608d793ed0e8ac550684
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several high-risk capabilities that, while aligned with its stated purpose of indexing and searching, could be easily abused for data exfiltration. Specifically, `scripts/folders.sh` contains functions (`_scan_folder`, `cmd_from_db`, `cmd_preview_db`) that allow reading arbitrary local text files and executing arbitrary SQL queries against accessible databases, then uploading the content/results to the remote API endpoint `https://apigcp.trynia.ai/v2`. While there is no clear evidence of intentional malicious behavior or prompt injection attempts in the `SKILL.md` to subvert the agent, these broad file and database access permissions represent a significant security risk if the agent were to be compromised or misused.