NVIDIA NIM Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:41 PM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but its API helper disables HTTPS certificate and hostname verification while sending an API key and prompts to NVIDIA, which makes it unsafe to install without review.

Review before installing. Only use this with non-sensitive prompts or files unless you are comfortable sending that data to NVIDIA NIM, and do not use the included script as-is on untrusted networks because it disables TLS verification while sending your API key. Rotate the NVIDIA key if this exact script has already been used in risky network conditions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/nim_call.py:37

Finding

TLS Certificate and Hostname Verification Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/nim_call.py, lines 37–43
Vulnerability Type: Improper Certificate Validation / CWE-295
Risk Level: High

Vulnerable Code

python

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

try:
    req = urllib.request.Request(url, data=json.dumps(data).encode(), headers=headers)
    with urllib.request.urlopen(req, context=ctx) as response:

Technical Analysis

The script creates a TLS context but then explicitly disables both hostname validation and certificate-chain verification. It passes that insecure context to urllib.request.urlopen() when submitting requests to the NVIDIA API.

Consequently, the client accepts an arbitrary certificate instead of verifying that the remote server controls a certificate valid for integrate.api.nvidia.com and issued by a trusted certificate authority. HTTPS encryption alone does not authenticate the endpoint under these settings.

Because the request carries the NVIDIA_API_KEY as a bearer credential and includes the complete user prompt, a network-positioned attacker can impersonate the API endpoint. This is particularly relevant to the documented workflow of sending long files or project material for external processing.

Attack Path

1. A user configures NVIDIA_API_KEY and invokes scripts/nim_call.py with a prompt.
2. The script constructs an HTTPS request containing the bearer API key and prompt.
3. An attacker obtains a network interception position, such as through a hostile Wi-Fi access point, compromised proxy, poisoned DNS path, or compromised network infrastructure.
4. The attacker presents a forged or self-signed certificate for the NVIDIA API hostname.
5. The script accepts the certificate because certificate and hostname validation are disabled.
6. The attacker decrypts or proxies the request, obtaining the API key and submitted prompt.
7. The attacker may also return a forged model respo ...[truncated 784 chars]

Remediation

View remediation

Remediation Suggestions

Retain Python's default certificate and hostname verification. Remove both insecure assignments:

python

ctx = ssl.create_default_context()

try:
    req = urllib.request.Request(
        url,
        data=json.dumps(data).encode(),
        headers=headers
    )
    with urllib.request.urlopen(req, context=ctx) as response:
        result = json.loads(response.read().decode())

Alternatively, omit the explicit context and allow urlopen() to use its verified default HTTPS handling:

python

with urllib.request.urlopen(req) as response:

Additional hardening measures:

1. Never set verify_mode to ssl.CERT_NONE in production code.
2. Never disable check_hostname for credential-bearing HTTPS requests.
3. If a private trust store is required, load a controlled CA bundle with ssl.create_default_context(cafile=...) rather than disabling verification.
4. Add a finite request timeout to limit stalled connections.
5. Add an automated test asserting that an untrusted or hostname-mismatched certificate causes the request to fail.
6. Rotate the NVIDIA API key if this implementation has been used over an untrusted network.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tainted flow: 'req' from os.getenv (line 44, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/nim_call.py (reported line 45)May include surrounding context.

python

try:
        req = urllib.request.Request(url, data=json.dumps(data).encode(), headers=headers)
        with urllib.request.urlopen(req, context=ctx) as response:
            result = json.loads(response.read().decode())
            return result['choices'][0]['message']['content']
    except Exception as e:

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code explicitly disables both certificate verification and hostname checking before making an HTTPS request. This allows a machine-in-the-middle attacker to intercept or alter traffic, including the user prompt and the NVIDIA API key, defeating the security guarantees of TLS.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly suggests using the skill to summarize local files through the NVIDIA NIM API, which implies transmitting potentially sensitive file contents to a third-party service. Because the documentation emphasizes token savings and convenience but does not warn about external data disclosure, users may unknowingly send secrets, proprietary code, or personal data off-host.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill describes functionality that relies on environment access for API credentials and network access to call external NVIDIA-hosted models, but it does not declare any explicit tool scope or permissions. In an agent framework, this weakens least-privilege controls and makes external data egress and secret usage less transparent, increasing the risk of unintended network calls or misuse of environment-held credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code reads an API key from the environment and sends the user-provided prompt to a remote NVIDIA API endpoint, but there is no confirmation prompt, user-facing log, or explanatory docstring/comment disclosing that data will be transmitted off-host. For a code file, remote transmission of user or system data without any visible warning meets the missing user warnings criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup instructions tell users to export an API key into an environment variable but provide no warning about secret handling, storage, shell history, or accidental disclosure. While common, this can lead to credential leakage through logs, screenshots, shared shell sessions, or unsafe persistence practices, especially in agent-driven environments that may access environment variables.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The natural-language comments in this file are written in Chinese, with no indication that the skill supports alternative languages or that the locale is intentionally restricted. Under the policy rule, forcing a specific language without user opt-in or documented justification is a locale-policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.