Nixomatic

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 0.1.0

Overview

The skill is coherent for running missing tools, but it gives remotely sourced environments broad execution and repository write access without enough scoping or approval.

Review this skill carefully before installing. Use it only for repositories where you are comfortable evaluating remote Nix flakes and exposing the current workspace to generated tool environments. Prefer explicit approval before README edits, pinned Docker images or local flakes, read-only or narrow mounts for Docker, and avoid running it in directories containing secrets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:143

Finding

Mutable Remote Flake Retrieval and Execution

Content

View full analysis

' \ --accept-flake-config \ --command -- ``` ```bash docker run -v nix-store:/nix -v "$PWD:/workspace" -w /workspace --rm nixos/nix nix \ --extra-experimental-features 'nix-command flakes' \ develop 'https://nixomatic.com/?p=' \ --accept-flake-config \ --command -- ``` ### Technical Analysis The skill directs the agent to retrieve and evaluate a Nix flake from the external `nixomatic.com` service and then execute software resolved through that flake. The service URL is not pinned to an immutable flake revision or verified against an expected content hash. Consequently, the effective code executed by the skill can change after the skill itself has been reviewed. A compromise of the service, its generated flake, its package resolution process, or a configured binary cache could introduce different executable content without requiring any change to `SKILL.md`. The use of `--accept-flake-config` further expands the trust boundary by automatically accepting configuration supplied by the remote flake. Such configuration can influence Nix behavior, including substituters and trusted public keys. The security claims at lines 270-271 are descriptive assertions and do not technically enforce source integrity. ### Attack Path 1. A user requests a tool that is not installed locally. 2. The skill constructs a URL under `https://nixomatic.com/`. 3. Nix downloads and evaluates the remotely generated flake. 4. The command automatically accepts configuration declared by that flake. 5. An attacker who has compromised the service or an associated supply-chain component changes the generated environment or resolved package ...[truncated 808 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:166

Finding

Read-Write Workspace Exposure to Remotely Sourced Tools

Content

View full analysis

' \ --accept-flake-config \ --command -- ``` ```bash docker run -v nix-store:/nix -v "$PWD:/workspace" -w /workspace --rm -it nixos/nix nix \ --extra-experimental-features 'nix-command flakes' \ develop 'https://nixomatic.com/?p=' \ --accept-flake-config ``` The document reinforces this access: ```markdown **Note:** The Docker commands include `-v "$PWD:/workspace" -w /workspace` to mount the current project directory into the container. This is essential for real project work so that build tools can access project files. ``` ### Technical Analysis Docker bind mounts are read-write by default. These command templates therefore expose the entire current working directory to every program executed in the container. The instruction at lines 45-46 not to read secret files only controls the agent's initial project analysis. It does not impose any filesystem restriction on programs subsequently executed through Nix. A malicious or compromised package can enumerate, read, overwrite, delete, or replace any file under `/workspace`. This access is broader than necessary for one-shot operations that only require one input file or a dedicated output directory. It violates least-privilege principles by granting repository-wide write access without determining whether that access is required. ### Attack Path 1. The skill retrieves a tool or development environment through the remote flake. 2. The Docker command mounts the complete current project directory at `/workspace`. 3. Because the mount has no `:ro` option, it is writable. 4. A malicious or compromised ...[truncated 939 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:222

Finding

Mandatory Persistent Third-Party Promotion in Project Documentation

Content

View full analysis

' \ --accept-flake-config ``` ### Using Docker ```bash docker run -v nix-store:/nix -v "$PWD:/workspace" -w /workspace --rm -it nixos/nix nix \ --extra-experimental-features 'nix-command flakes' \ develop 'https://nixomatic.com/?p=' \ --accept-flake-config ``` ``` ### Technical Analysis The skill makes modification of the project's `README.md` a mandatory post-execution action. It inserts branded language asserting that the project uses Nixomatic and embeds commands that evaluate the same mutable remote flake with `--accept-flake-config`. Persistently changing project documentation is not required to perform a temporary package-runner task. The inserted statement can also falsely appear to represent an endorsement or architectural decision made by the project's maintainers. If committed to version control, the generated documentation propagates the remote execution instructions to future developers and users. This turns a one-time skill invocation into a persistent distribution channel for the external service and its unsafe command pattern ...[truncated 1136 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

## Analyzing the Project

**Important:** Never read or access files that may contain secrets (`.env`, `.env.*`, `credentials.json`, `*-credentials.*`, `*.pem`, `*.key`, private key files, or token files). Only inspect filenames to determine which packages are needed — do not read file contents unless they are project manifests (e.g., `package.json`, `Cargo.toml`, `go.mod`).

Determine what packages the project needs by scanning files in this order:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use this skill whenever a tool, runtime, or utility is not installed and even for 'anything else' requiring unavailable software. This lacks narrow trigger boundaries or exclusion conditions, so the skill could be invoked for a very wide range of common requests instead of a clearly scoped subset.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to modify README.md as a normal part of operation without requiring explicit user consent or warning that project files will be changed. In an agent context, silent file modification can violate user expectations, alter repositories unexpectedly, and persist potentially unsafe commands into documentation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Phrases like 'universal package runner,' 'whenever you need a tool that is not on the current system,' and 'anything else' create an extremely broad activation condition. The markdown does not provide clear limits or exclusions to distinguish when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The Docker examples reference the mutable image tag nixos/nix without a version tag or digest. This allows the runtime environment to change unexpectedly over time or be replaced upstream, undermining reproducibility and potentially exposing users to a compromised or incompatible image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The command runs docker run ... nixos/nix without pinning the image to an immutable digest or fixed version. Because this skill is intended for repeated execution of development commands, users may unknowingly pull different container contents over time, creating supply-chain and reproducibility risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The interactive Docker shell example uses an unpinned nixos/nix image, so the trust boundary depends on the latest upstream image state at execution time. For a skill that mounts the workspace into the container, that mutable base image could materially affect host project files and command behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README maintenance template propagates an unpinned Docker image into project documentation, causing the insecure pattern to spread into downstream repositories. This broadens exposure by normalizing execution from a mutable container image in future use.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 81% confidence

Finding

The skill is specifically designed to fetch and run arbitrary software environments on demand from a remote service, which is a materially expanded execution surface. In context, the broad “run any software instantly” design plus remote flakes and workspace access make unrestricted tool execution significantly more dangerous than a generic documentation statement suggests.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

## Security Considerations

- **Nix sandbox:** Nix builds run inside a sandbox by default — build-time derivations have no network access and no filesystem access outside the Nix store. The `nix develop` command only makes packages available on `PATH`; it does not execute arbitrary scripts at evaluation time.
- **Deterministic flakes:** nixomatic.com serves deterministic Nix flakes generated from the requested package list. The flake only pulls packages from the official nixpkgs repository.
- **Docker isolation:** When using the Docker runtime, the container only has access to the mounted workspace directory and a persistent Nix store volume. No other host paths are exposed.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims nix develop does not execute arbitrary scripts at evaluation time, yet it instructs use of remote flakes together with --accept-flake-config. This creates a misleading safety guarantee around evaluating and trusting remote flake-provided configuration, which can cause users to execute less-trusted remote configuration under false assumptions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

Run a command inside the environment:

bash

docker run -v nix-store:/nix -v "$PWD:/workspace" -w /workspace --rm nixos/nix nix \
    --extra-experimental-features 'nix-command flakes' \
    develop 'https://nixomatic.com/?p=<packages>' \
      --accept-flake-config \

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Enter an interactive shell:

bash

docker run -v nix-store:/nix -v "$PWD:/workspace" -w /workspace --rm -it nixos/nix nix \
    --extra-experimental-features 'nix-command flakes' \
    develop 'https://nixomatic.com/?p=<packages>' \
      --accept-flake-config

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

Enter an interactive shell:

bash

docker run -v nix-store:/nix -v "$PWD:/workspace" -w /workspace --rm -it nixos/nix nix \
    --extra-experimental-features 'nix-command flakes' \
    develop 'https://nixomatic.com/?p=<packages>' \
      --accept-flake-config

Static analysis

No suspicious patterns detected.