Nyne Deep Research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:12 PM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it enables deep profiling of real people with weak privacy, consent, credential, and data-handling safeguards.

Install only if you have a legitimate, authorized reason to send a person's identifiers to Nyne and receive a detailed dossier about them. Avoid using it for covert profiling, harassment, discrimination, or sensitive decisions; prefer temporary credentials, do not print secret fragments, and avoid saving full results to predictable temp files or webhook destinations you do not control.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:110
• Finding: Predictable Temporary File Exposes Sensitive Intelligence Dossiers<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:110-120` **Vulnerability Type**: Unsafe temporary-file handling and plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code ```bash while [ $SECONDS_WAITED -lt 600 ]; do curl -s "https://api.nyne.ai/person/deep-research?request_id=$REQUEST_ID" \ -H "X-API-Key: $NYNE_API_KEY" \ -H "X-API-Secret: $NYNE_API_SECRET" | nyne_parse > /tmp/nyne_response.json STATUS=$(jq -r '.data.status' /tmp/nyne_response.json) echo "Status: $STATUS ($SECONDS_WAITED seconds elapsed)" if [ "$STATUS" = "completed" ]; then jq '.data.result' /tmp/nyne_response.json break elif [ "$STATUS" = "failed" ]; then echo "Research failed." jq . /tmp/nyne_response.json ``` The same fixed path is also used by the polling example at `SKILL.md:239-253` and referenced throughout `SKILL.md:365-393`. ### Technical Analysis The API response is written to the predictable shared path `/tmp/nyne_response.json`. The documented response can contain email addresses, phone numbers, social profiles, employment and education history, political leanings, psychographic details, relationships, and other sensitive personal information. The instructions do not securely create the file, set restrictive permissions, verify that the path is a regular file owned by the current user, or remove the file after use. Because shell redirection follows symbolic links, a local attacker may be able to pre-create the path as a symlink and redirect the write. Depending on operating-system protections and process privileges, this could overwrite another writable file. A local process may also monitor or read the predictable file if its permissions allow access. The file remains on disk after processing, increasing the period during which the dossier can be recovered or accessed. ### Attack Path 1. An attacker with local access monitors the predictable `/tmp/nyne_response.json` path or creates it before the victi ...[truncated 1180 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create a unique temporary file with restrictive permissions and guarantee its deletion: ```bash umask 077 RESPONSE_FILE=$(mktemp "${TMPDIR:-/tmp}/nyne_response.XXXXXX") || exit 1 trap 'rm -f -- "$RESPONSE_FILE"' EXIT HUP INT TERM curl --fail --silent --show-error \ "https://api.nyne.ai/person/deep-research?request_id=$REQUEST_ID" \ -H "X-API-Key: $NYNE_API_KEY" \ -H "X-API-Secret: $NYNE_API_SECRET" | nyne_parse > "$RESPONSE_FILE" STATUS=$(jq -r '.data.status' "$RESPONSE_FILE") ``` Additional hardening measures: - Never use a constant filename in a shared temporary directory. - Check that temporary-file creation succeeds before sending the API request. - Quote every reference to the generated path. - Keep `umask 077` active while handling dossier data. - Avoid writing the full response to disk where streaming or in-memory processing is practical. - Redact unnecessary personal fields before displaying or retaining results. - Define and enforce an explicit retention policy for any intentionally saved dossier. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:52
• Finding: API Credentials Are Persisted in an Unprotected Plaintext File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-59` **Vulnerability Type**: Insecure credential storage **Risk Level**: Medium ### Vulnerable Code ```bash # Create .env file (keep out of version control) echo 'export NYNE_API_KEY="your-api-key"' >> ~/.nyne_env echo 'export NYNE_API_SECRET="your-api-secret"' >> ~/.nyne_env source ~/.nyne_env ``` ### Technical Analysis The setup instructions recommend persisting the Nyne API key and secret in a plaintext shell file. They do not set or verify restrictive file permissions, validate file ownership, or ensure that `~/.nyne_env` is a regular file rather than a symbolic link. The resulting permissions depend on the user's current `umask` and any pre-existing file permissions. If the file is group-readable or world-readable, another local account can obtain both credentials. Appending to an unverified path can also be unsafe if an attacker can manipulate the file or its parent directory. Using `source ~/.nyne_env` executes the file as shell code. If another local principal can modify that file, the next sourcing operation executes attacker-controlled commands with the victim user's privileges. ### Attack Path 1. The victim follows the documented instructions and stores the API key and secret in `~/.nyne_env`. 2. The file is created or reused without an explicit permission or ownership check. 3. Another local user or compromised process reads the file if permissions permit. 4. The attacker extracts `NYNE_API_KEY` and `NYNE_API_SECRET`. 5. The attacker uses those credentials to submit unauthorized research requests, consume account credits, or retrieve data accessible through the account. 6. If the attacker can modify the file, the attacker inserts shell commands that execute when the victim next runs `source ~/.nyne_env`. ### Impact Assessment Credential theft grants the attacker the API access associated with the victim's Nyne account. This may permit unauthorized person-research requests, cr ...[truncated 420 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Prefer an operating-system credential manager, secret-management service, or runtime-only environment injection. If a local file is required, create and validate it securely: ```bash CREDENTIAL_FILE="$HOME/.nyne_env" if [ -e "$CREDENTIAL_FILE" ] && [ ! -f "$CREDENTIAL_FILE" ]; then echo "Refusing to use a non-regular credential path" >&2 exit 1 fi umask 077 install -m 600 /dev/null "$CREDENTIAL_FILE" || exit 1 printf '%s\n' \ 'export NYNE_API_KEY="your-api-key"' \ 'export NYNE_API_SECRET="your-api-secret"' \ > "$CREDENTIAL_FILE" chmod 600 "$CREDENTIAL_FILE" ``` Further safeguards should include: - Verify that the file is owned by the current user before reading or replacing it. - Do not append credentials to an existing, unverified path. - Keep the file outside version-controlled directories. - Rotate credentials immediately if exposure is suspected. - Use narrowly scoped and revocable credentials where supported. - Avoid sourcing writable configuration files. Parse data-only configuration rather than executing it as shell code. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:61
• Finding: Credential Prefixes Are Disclosed in Terminal and Log Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61-64` **Vulnerability Type**: Partial secret disclosure **Risk Level**: Low ### Vulnerable Code ```bash Verify they're set: ```bash echo "Key: ${NYNE_API_KEY:0:8}... Secret: ${NYNE_API_SECRET:0:6}..." ``` ``` ### Technical Analysis The verification command prints the first eight characters of the API key and the first six characters of the API secret. Secret verification does not require revealing any part of either credential. Terminal output may be retained by CI/CD logs, shell-session recording software, support transcripts, remote administration systems, or copied diagnostic output. Although the command does not disclose complete credentials, prefixes can identify credential families, correlate credentials across incidents, reduce uncertainty during guessing attacks, and expose information that should remain confidential. ### Attack Path 1. The victim runs the documented verification command in a terminal, automated setup job, or recorded support session. 2. The command prints fragments of both credentials. 3. A logging system, screen recording, shared transcript, or unauthorized observer captures the output. 4. The attacker uses the fragments to correlate leaked credentials, identify the relevant account or credential type, or assist another credential-recovery attempt. ### Impact Assessment This issue does not directly reveal enough information to authenticate to the API by itself. Its primary impact is unnecessary partial disclosure and increased usefulness of other leaked information. The exposed scope is limited to the printed prefixes, but those values may persist in logs beyond the lifetime of the credentials. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Verify only that both variables are non-empty without printing any portion of them: ```bash if [ -n "${NYNE_API_KEY:-}" ] && [ -n "${NYNE_API_SECRET:-}" ]; then echo "Nyne credentials are configured." else echo "Nyne credentials are not configured." >&2 exit 1 fi ``` For stronger verification, make a minimally privileged authentication or account-status request and report only whether authentication succeeded. Ensure that diagnostic logs never include authorization headers, environment-variable values, or secret fragments. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (23)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly facilitates submitting third-party personal identifiers (email, phone, social URLs, name/company/city) to an external profiling service, yet its description contains no user warning about transmitting personal data or generating sensitive intelligence dossiers. This omission materially increases the risk of non-consensual surveillance, privacy harm, and misuse because users are not prompted to consider consent, legality, or sensitivity before using the skill.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The agent instructions tell the model to present maximum depth and display every section in full, including psychographic, personal-life, social-graph, relationship, warning, and 'creepy-good insights' sections, with no privacy guardrails. That instruction encourages unnecessary disclosure of highly sensitive personal profiling data and defeats data minimization, making misuse substantially easier.

Ssd 3

High

• Confidence: 99% confidence
• Finding: These instructions direct the agent to reveal the entire dossier sequentially, including personal life, social graph, key relationships, warnings/landmines, and psychographic profiling, instead of minimizing private data. In the context of a person-intelligence tool, this substantially raises the chance of doxxing, stalking, manipulation, or discriminatory profiling by operationalizing sensitive inferences for end users.

Credential Access

High

• Category: Privilege Escalation

Content

To persist across sessions, add the exports to your shell profile (`~/.zshrc`, `~/.bashrc`, etc.) or create a `.env` file and source it:
```bash
# Create .env file (keep out of version control)
echo 'export NYNE_API_KEY="your-api-key"' >> ~/.nyne_env
echo 'export NYNE_API_SECRET="your-api-secret"' >> ~/.nyne_env
source ~/.nyne_env

• Confidence: 92% confidence
• Finding: The skill instructs users to persist API credentials in a sourced local file, which normalizes long-lived secret storage and increases the chance of accidental disclosure through shell history, misconfigured permissions, backups, or shared environments. While common operational guidance, it is risky in agent contexts because secrets may be broadly accessible or inadvertently exfiltrated by other tools.

Session Persistence

Medium

• Category: Rogue Agent

Content

export NYNE_API_SECRET="your-api-secret"
```

To persist across sessions, add the exports to your shell profile (`~/.zshrc`, `~/.bashrc`, etc.) or create a `.env` file and source it:
```bash
# Create .env file (keep out of version control)
echo 'export NYNE_API_KEY="your-api-key"' >> ~/.nyne_env

• Confidence: 85% confidence
• Finding: The instructions encourage persisting credentials across sessions by modifying shell profiles or sourcing a local env file, which broadens the lifetime and exposure of secrets beyond the immediate task. Persistent environment configuration can unintentionally grant unrelated sessions or tools access to the API credentials.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

# Submit research request
REQUEST_ID=$(curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 96% confidence
• Finding: This code sends user-supplied personal identifiers to api.nyne.ai over the network to initiate profiling. While external transmission is the core function of the skill, it is still security-relevant because the transmitted data is highly sensitive and the documentation does not include strong consent, notice, or minimization safeguards.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

# Submit research request
REQUEST_ID=$(curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 96% confidence
• Finding: This code sends user-supplied personal identifiers to api.nyne.ai over the network to initiate profiling. While external transmission is the core function of the skill, it is still security-relevant because the transmitted data is highly sensitive and the documentation does not include strong consent, notice, or minimization safeguards.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Poll until complete (checks every 5s, times out after 10 min)
SECONDS_WAITED=0
while [ $SECONDS_WAITED -lt 600 ]; do
  curl -s "https://api.nyne.ai/person/deep-research?request_id=$REQUEST_ID" \
    -H "X-API-Key: $NYNE_API_KEY" \
    -H "X-API-Secret: $NYNE_API_SECRET" | nyne_parse > /tmp/nyne_response.json
  STATUS=$(jq -r '.data.status' /tmp/nyne_response.json)

• Confidence: 90% confidence
• Finding: Polling the external endpoint retrieves the completed dossier from Nyne, which may contain sensitive personal data, and writes it to a local temporary file. This extends the exposure surface because sensitive results are both transmitted from the third-party service and stored locally without any caution about handling or disposal.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Submit Research (POST)

**Endpoint:** `POST https://api.nyne.ai/person/deep-research`

**Headers:**
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Submit Research (POST)

**Endpoint:** `POST https://api.nyne.ai/person/deep-research`

**Headers:**
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documented callback_url parameter enables the service to POST completed results to an external webhook, but the skill provides no warning that sensitive dossier data may be automatically transmitted to another system. This creates a real risk of inadvertent exfiltration, especially if users supply third-party or misconfigured webhook endpoints.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By email:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 95% confidence
• Finding: This example transmits an email address for a third party to an external profiling API. The danger comes from enabling non-consensual research on real people using direct identifiers without a warning or validation step, which can expose users and subjects to privacy and compliance risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By email:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 95% confidence
• Finding: This example transmits an email address for a third party to an external profiling API. The danger comes from enabling non-consensual research on real people using direct identifiers without a warning or validation step, which can expose users and subjects to privacy and compliance risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By social media URL:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 94% confidence
• Finding: This example sends a social media profile URL to an external service for deep profiling. Social URLs are still personal data, and the surrounding instructions normalize third-party enrichment and inference generation without any notice about sensitivity or acceptable-use constraints.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By social media URL:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 94% confidence
• Finding: This example sends a social media profile URL to an external service for deep profiling. Social URLs are still personal data, and the surrounding instructions normalize third-party enrichment and inference generation without any notice about sensitivity or acceptable-use constraints.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By multiple social URLs:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 94% confidence
• Finding: This example transmits multiple social profile URLs, increasing the breadth of data aggregation and enabling more comprehensive cross-platform profiling. The absence of warnings or limits around combining identifiers makes the skill more dangerous in practice because it facilitates richer dossiers on third parties.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By multiple social URLs:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 94% confidence
• Finding: This example transmits multiple social profile URLs, increasing the breadth of data aggregation and enabling more comprehensive cross-platform profiling. The absence of warnings or limits around combining identifiers makes the skill more dangerous in practice because it facilitates richer dossiers on third parties.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By name + company:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 93% confidence
• Finding: This example sends a person's name plus employer to disambiguate identity for external profiling, which supports targeted research on real individuals. The risk is amplified because employer context can reduce ambiguity and improve matching accuracy, making non-consensual identification easier.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By name + company:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 93% confidence
• Finding: This example sends a person's name plus employer to disambiguate identity for external profiling, which supports targeted research on real individuals. The risk is amplified because employer context can reduce ambiguity and improve matching accuracy, making non-consensual identification easier.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By phone:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 96% confidence
• Finding: This example transmits a phone number, a highly sensitive and strongly identifying datum, to an external API for dossier generation. Using phone numbers materially increases privacy risk, potential re-identification, and misuse potential compared with less specific identifiers.

External Transmission

Medium

• Category: Data Exfiltration

Content

**By phone:**
```bash
curl -s -X POST "https://api.nyne.ai/person/deep-research" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" \

• Confidence: 96% confidence
• Finding: This example transmits a phone number, a highly sensitive and strongly identifying datum, to an external API for dossier generation. Using phone numbers materially increases privacy risk, potential re-identification, and misuse potential compared with less specific identifiers.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Check status once
```bash
curl -s "https://api.nyne.ai/person/deep-research?request_id=$REQUEST_ID" \
  -H "X-API-Key: $NYNE_API_KEY" \
  -H "X-API-Secret: $NYNE_API_SECRET" | nyne_parse | jq '{status: .data.status, completed: .data.completed}'
```

• Confidence: 88% confidence
• Finding: This example retrieves sensitive status/result data from the external service. Although the request itself is expected behavior, the skill lacks guidance on limiting who can access returned request IDs and outputs, which can expose sensitive dossier results if shared or logged carelessly.

External Transmission

Medium

• Category: Data Exfiltration

Content

TIMEOUT=600  # 10 minutes

while [ $SECONDS_WAITED -lt $TIMEOUT ]; do
  curl -s "https://api.nyne.ai/person/deep-research?request_id=$REQUEST_ID" \
    -H "X-API-Key: $NYNE_API_KEY" \
    -H "X-API-Secret: $NYNE_API_SECRET" | nyne_parse > /tmp/nyne_response.json
  STATUS=$(jq -r '.data.status' /tmp/nyne_response.json)

• Confidence: 90% confidence
• Finding: The full polling loop repeatedly retrieves sensitive dossier data and stores it in /tmp/nyne_response.json, increasing the window and surface for local exposure. On multi-user systems or shared agent environments, predictable temp-file handling can leak private results to other processes or users.

Static analysis

No suspicious patterns detected.