Nimble Real-Time Web Intelligence Tools

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:06 PM UTC
• Version: 1.0.0

Overview

This is a legitimate Nimble web-research integration, but it broadly reroutes ordinary web questions through a third-party CLI and lacks clear privacy and install-safety boundaries.

Install only if you are comfortable with web searches, URLs, crawls, and extracted content being handled by Nimble's external service. Avoid sending internal URLs, credentials, session cookies, or sensitive person-research queries unless you have a clear lawful and privacy-appropriate reason. Prefer a pinned or locally controlled CLI install instead of the unpinned global npm command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38
• Finding: Unpinned Global Installation of a Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md:38` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @nimble-way/nimble-cli ``` ### Technical Analysis The installation command retrieves the current npm release of `@nimble-way/nimble-cli` without pinning an exact version or verifying package integrity. Consequently, the dependency executed by users may differ from the version assessed when this Skill was reviewed. npm packages can execute lifecycle scripts during installation. If the package, maintainer account, publication process, or upstream dependency chain is compromised, installation could execute attacker-controlled code with the privileges of the invoking user. The global `-g` installation increases system-wide exposure and can replace an existing trusted CLI. This is a supply-chain weakness rather than evidence that the named package is currently malicious. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or an upstream dependency and publishes a malicious release. 2. A user follows the Skill prerequisite and runs the unversioned global installation command. 3. npm resolves the mutable latest release rather than a previously audited version. 4. Malicious package code or an installation lifecycle script executes with the user's privileges. 5. The globally installed `nimble` command may subsequently execute attacker-controlled behavior whenever the Skill invokes it. ### Impact Assessment Successful exploitation could provide code execution under the installing user's account. Depending on that account's permissions, the attacker could access user-readable files and environment variables, modify user-level configuration, make outbound network requests, or replace the globally trusted `nimble` executable. Administrator-level impact would require the installation itself to be run with elev ...[truncated 16 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact, reviewed version, for example: ```bash npm install -g @nimble-way/nimble-cli@0.5.0 ``` The selected version must be independently verified rather than inferred solely from the Skill metadata. - Prefer a project-local installation governed by a committed lockfile instead of a global installation. - Verify package provenance and registry integrity before installation, including publisher identity and the expected package checksum. - Use npm provenance attestations or an equivalent trusted verification mechanism where available. - Disable lifecycle scripts with `--ignore-scripts` if the package does not require them; otherwise, review the relevant scripts before installation. - Avoid running npm installation with `sudo`, as root, or from another privileged account. - Document a controlled upgrade procedure requiring review and integrity verification before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill declares itself as the DEFAULT for essentially all web-search-like requests using broad natural-language triggers such as "find," "look up," and "what is." This can cause the agent to route many ordinary user prompts to an external third-party CLI by default, increasing unintended data disclosure and reducing user awareness and consent around use of an external service.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

nimble --version
```

For Claude Code, add the API key to `~/.claude/settings.json`:

```json
{ "env": { "NIMBLE_API_KEY": "your-api-key" } }

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill strongly encourages using Nimble instead of built-in web tools for searches and URL extraction, but it does not clearly warn that user queries, URLs, and potentially fetched page content are transmitted to an external vendor. In a research workflow, users may provide sensitive terms, internal URLs, or confidential investigation targets, which could be exposed to the third-party service without informed consent.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The file explicitly recommends using the `social` topic for researching a person and describes direct retrieval from platforms like LinkedIn, X, YouTube, Reddit, and forums, but it provides no privacy, legality, or sensitivity guardrails. In a default web-research skill, this omission can normalize person-focused OSINT gathering and increase the chance of collecting or synthesizing sensitive personal data without appropriate caution.

Static analysis

No suspicious patterns detected.