Nima Core

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:26 AM UTC
• Version: 3.1.5

Overview

This appears to be a real memory and affect skill, but it installs persistent agent hooks with broad context injection, local inspection, and optional external data sharing that are not scoped clearly enough in the manifest.

Review install.sh and the OpenClaw hooks before installing. Use this only if you want persistent agent memory that reads conversations and injects context into prompts. Prefer local embeddings, avoid enabling Telegram or precognitive cron jobs unless you understand what they may expose, and do not load untrusted legacy pickle memory files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (112)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pkg_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    install_script = os.path.join(pkg_dir, 'install.sh')
    if os.path.exists(install_script):
        subprocess.run(['bash', install_script], cwd=pkg_dir)
    else:
        print("NIMA Core v" + __version__)
        print("Run ./install.sh from the nima-core directory to set up hooks.")

• Confidence: 91% confidence
• Finding: subprocess.run(['bash', install_script], cwd=pkg_dir)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _shell(cmd: str, timeout: int = 10) -> str:
    """Run a shell pipeline (only for trusted, static commands). Never pass user input."""
    try:
        r = subprocess.run(["sh", "-c", cmd], capture_output=True, text=True, timeout=timeout)
        return r.stdout.strip()[:500]
    except (subprocess.TimeoutExpired, subprocess.CalledProcessError, OSError, FileNotFoundError) as e:
        logger.warning("Command failed: %s", e)

• Confidence: 97% confidence
• Finding: r = subprocess.run(["sh", "-c", cmd], capture_output=True, text=True, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 375, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
            method="POST"
        )
        with urllib.request.urlopen(req, timeout=8) as resp:
            data = _json.loads(resp.read())
            emb = data["data"][0]["embedding"]
            if verbose: print(f"[ladybug_recall] ✅ Voyage embedding (API): {len(emb)}D", file=sys.stderr)

• Confidence: 93% confidence
• Finding: with urllib.request.urlopen(req, timeout=8) as resp:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The skill description presents the package primarily as a memory and emotional-intelligence component, but the documentation also describes installing hooks into the agent runtime, modifying prompt/context flow, executing shell-based installation steps, and broad persistence behavior. That gap matters because users may authorize a seemingly narrow memory feature without realizing it can alter agent execution and inject context at startup, increasing the risk of over-privileged deployment and unintended data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documentation extends a memory plugin into predictive session preparation that reads cached precognitions, resolves model tiers, and runs workspace-aware actions such as git status and open PR checks. That broadens the skill from passive memory into anticipatory context gathering and environment inspection, increasing the chance of unintended data access and context injection beyond user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The cron job examples instruct the agent to send task results to Telegram, introducing an unrelated outbound communication channel into a memory skill. Because those jobs operate on memory, consolidation, and workspace-derived outputs, they can exfiltrate sensitive summaries or operational details to a third-party destination if copied into production unchanged.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The README makes strong privacy assurances such as 'Everything lives on your machine' and 'No phoning home' while also documenting configurations that can send conversation-derived data to third-party embedding or LLM providers. That mismatch can mislead operators into enabling the skill under a false assumption of fully local processing, increasing the risk of unintentional data disclosure.

Scope Creep

Medium

• Confidence: 93% confidence
• Finding: The manifest permissions list writes to ~/.nima/ but omit the documented write to ~/.openclaw/extensions/ during installation. Undeclared modification of the agent's extension directory is security-relevant because it changes runtime behavior and persistence surface outside the declared write scope, undermining informed consent and permission enforcement.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The installer copies multiple OpenClaw extensions into the user's global extensions directory, including components like `skill-router` and `nima-affect`, which exceeds a narrowly scoped memory/recall install and creates persistent integration into another agent platform. Even if intended as convenience, silently deploying gateway hooks broadens the attack surface and grants the package ongoing influence over agent behavior outside the core library itself.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: In update mode, the script attempts to restart the OpenClaw gateway automatically if the `openclaw` command exists. Restarting an external agent gateway changes runtime state and activates newly installed code immediately, which is a sensitive side effect not strictly required for a library install and can surprise users or chain into broader system behavior.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: A memory/emotion skill exposing a CLI that directly runs a shell installer is outside the core functionality expected from the package and creates unnecessary execution capability. In agent or automated environments, this can lead to unintended system modification or arbitrary code execution if the package contents are compromised or the entry point is triggered without full user review.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The docstring describes main() as a setup wizard, but the implementation silently delegates to an external shell script instead of performing transparent, in-process setup. This mismatch reduces auditability and can mislead users or reviewers about the real behavior, making risky code execution easier to overlook.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The module performs broad local reconnaissance by querying git state, PRs, CI runs, service health, logs, research files, assets, and calendar data, which exceeds the advertised core memory function. In an agent context, this expands the data-access surface and can expose sensitive operational and personal information to downstream model prompts or caches without a clear permission boundary.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill description emphasizes memory and affect features, but this module conducts wide workspace and operational inspection, creating a mismatch between expected and actual behavior. That mismatch is security-relevant because users may install it under the assumption of limited memory functionality while it silently gathers repo, service, document, and personal-context data.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module-level security claims say loading is safe from untrusted sources because JSON is used, but the public load() API still auto-detects non-JSON files and deserializes them with pickle. That mismatch is dangerous because users may trust the documentation and pass attacker-controlled legacy files into an API path that can trigger arbitrary code execution during unpickling.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The inline comment asserts there is no arbitrary code execution risk and that loading is safe from untrusted sources, but later code preserves a legacy pickle loading path. This creates a false sense of safety for developers and operators, increasing the chance they will expose load() to untrusted files and thereby enable code execution.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The migration guide correctly notes that pickle loading can execute arbitrary code, yet the recommended migration procedure tells users to call sbm.load() on existing .pkl files. That guidance normalizes an unsafe workflow and may lead users to load malicious or tampered pickle files during migration.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The function advertised as a database sync routine also performs a side-effecting source-control commit, which exceeds caller expectations and violates separation of duties. In an agent skill context, merely triggering a sync can mutate a repository and persist potentially sensitive memory content to VCS, creating unintended data disclosure, audit noise, or workflow abuse if invoked automatically or by another component.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file introduces a Redis-backed HiveBus that enables real-time inter-agent messaging, which is materially broader than the stated memory-sharing functionality. Even if optional, this expands the attack surface by creating a network communication path that can be used for unintended coordination, data movement, or abuse if Redis is exposed or misconfigured.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code performs external Redis communication for publish/subscribe messaging, which is not necessary to fulfill the core memory entanglement purpose described for the skill. This creates a covert or poorly disclosed egress path for agent content and metadata, increasing exposure if messages contain sensitive prompts, outputs, or identifiers.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The active_agents and heartbeat features allow enumeration of participating agents via Redis keys, adding presence tracking outside the core memory function. While not directly destructive, this can reveal operational topology, timing, and participation information that may aid lateral coordination or monitoring.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The module automatically reads ~/.nima/.env and injects its contents into process-wide environment variables at import time, which is a hidden side effect and a form of credential ingestion broader than a caller would reasonably expect from importing a library. In agent/plugin contexts this can silently pull secrets into memory and make them available to unrelated code paths, increasing exposure and enabling unintended outbound use of credentials.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The function advertises memory-repo tracking but also stages top-level workspace files outside the memory directory, causing broader file capture than a caller may expect. In an agent setting, this can silently commit sensitive workspace data into the memory git history, increasing risk of unintended retention and later disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The files parameter is passed directly to git add with no path restrictions, allowing arbitrary files accessible to the process to be staged into the repository. In an AI-agent context, any upstream tool or prompt that can influence this argument could cause collection and persistence of unrelated or sensitive files under the guise of memory tracking.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This module extends a memory system into external LLM-based prediction generation and later prompt injection, which is a material capability change from simple recall/storage. That mismatch matters because users may grant or deploy the skill expecting local memory behavior, while the code actually derives and reuses memory content in downstream model interactions.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.