Nia

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:55 AM UTC
• Version: 1.0.3

Overview

This is a real Nia cloud integration, but it can upload local files, dependency manifests, and database connection/query details to Nia with limited runtime warnings.

Install only if you are comfortable sending selected local files, dependency manifests, search queries, and any supplied database connection/query information to Nia's cloud API. Avoid pointing it at secret-heavy directories, use least-privilege database credentials, review files before running folder/advisor/dependency commands, and protect ~/.config/nia/api_key with restrictive permissions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents extensive shell and network capabilities through numerous curl-based scripts, yet it declares no permissions. This weakens user and platform visibility into what the skill can actually do, increasing the risk of unexpected outbound requests, remote data access, and execution of sensitive operations such as database preview/import workflows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The declared description understates the full operational scope of the skill. In addition to indexing and search, it exposes broader capabilities including web research, autonomous GitHub search jobs, category management, usage inspection, and especially database connection/query ingestion, which can cause users to grant trust or provide inputs they would not if the real behavior were clearly disclosed.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to place a long-lived API key directly into a plaintext file under ~/.config/nia/api_key without any warning about credential sensitivity, file permissions, or safer storage options. If the local machine is shared, compromised, backed up insecurely, or the config directory is exposed, the credential can be stolen and used to access the user's Nia account and indexed data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructions tell users to store the API key in plaintext under ~/.config/nia/api_key without any warning about filesystem exposure, backups, multi-user access, or accidental inclusion in diagnostics. Plaintext credential storage increases the chance of token theft from local compromise, misconfigured permissions, or secret leakage through tooling and logs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script reads each user-supplied local file and embeds its full contents into the JSON request sent to the remote advisor service. Although this behavior is consistent with the tool’s purpose, there is no explicit warning, confirmation, filtering, or size/sensitivity check before exfiltrating potentially confidential source code, secrets, or proprietary data.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script includes repository and documentation scope metadata from environment variables in the request without surfacing that behavior to the user at runtime. While less sensitive than raw file content, these values can still disclose internal repository names, documentation sources, or project structure that may be confidential in enterprise environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The analyze command reads the entire local manifest file and sends its contents to a remote API endpoint. While this appears consistent with the tool's intended functionality, it creates a real data-exfiltration risk because package manifests can contain internal repository names, private registries, dependency sources, and other sensitive metadata, and the script provides no explicit warning or confirmation before transmission.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The subscribe operation also transmits the full manifest content to a remote API, but its name emphasizes dependency subscription rather than clearly warning that local file contents are uploaded. In enterprise or private-code contexts, this can leak internal package names, private dependencies, or development tooling details to an external service without sufficiently explicit disclosure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The upload command sends a local file over the network and includes a bearer token in the request, which is expected for authenticated API use but still represents a real security-sensitive action. The danger is increased by the lack of explicit disclosure or confirmation, because users may not realize they are transmitting local project files and authenticating to an external service, potentially exposing sensitive manifest data if used in private repositories.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The create operation scans a local directory, reads file contents, and uploads them to a remote endpoint as JSON, but the script provides no explicit warning, confirmation, or dry-run summary that content will leave the local machine. In a tool marketed for indexing/searching private folders, this can easily cause accidental exfiltration of sensitive source code, secrets, credentials, or proprietary documents if the user misunderstands the operation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The sync operation re-scans a local folder and retransmits file contents to a remote endpoint without an explicit warning that local data is being uploaded again. This creates the same accidental data exposure risk as create, and may be more surprising because users may treat sync as a metadata refresh rather than full content retransmission.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The from-db command packages a database connection string, query, and optional schema details and sends them to a remote endpoint, with no explicit warning about transmitting credentials or potentially sensitive query results. Connection strings often embed usernames, passwords, hosts, and database names, so this can expose infrastructure secrets and regulated data far beyond ordinary file indexing.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The preview-db command sends database connection details and SQL query text to a remote service to preview rows, again without any explicit disclosure to the user. Even though it is a preview, it still risks leaking credentials, internal topology, schema information, and sample sensitive records to the remote platform.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends user queries plus optional repository, document, and local folder metadata to a remote search endpoint via nia_post, but it does not clearly warn the caller at execution time that this data leaves the local environment. In a skill explicitly designed to index/search local folders and other sources, users may unintentionally disclose sensitive filenames, paths, document identifiers, or query contents to an external service.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The web, deep, and universal commands all build request payloads and send them to a remote endpoint, but the script provides no explicit runtime notice that query data is transmitted over the network. While remote access is expected for search features, the lack of disclosure can still cause accidental sharing of sensitive research queries or internal terms, particularly in the universal mode that may span indexed sources.

VirusTotal

48/48 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.