Nix Run

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:53 PM UTC
• Version: 1.0.0

Overview

This skill is a broad Nix command runner with disclosed purpose, but it over-directs agents into using it for all CLI work and contains a real command-execution injection risk in its search option.

Review this before installing in any sensitive workspace. It is meant to run arbitrary commands and may download and execute packages from a moving Nix source. Avoid passing untrusted values to --limit or --search, and prefer a fixed, audited nixpkgs revision plus narrower activation rules before using it with private files, credentials, or write access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/nix-run.sh:99

Finding

Arbitrary Python Code Execution Through Unvalidated --limit Input

Content

View full analysis

Remediation

View remediation

= 1 && 10#$2 <= 100 )) || die "--limit must be between 1 and 100" SEARCH_LIMIT="$2" ``` 2. Never interpolate the value into Python source. Pass it as a positional argument: ```bash printf '%s\n' "$json" | nix run "${NIXPKGS_REF}#python3" -- -c ' import json import sys limit = int(sys.argv[1]) data = json.load(sys.stdin) # ... items = list(seen.items())[:limit] ' "$SEARCH_LIMIT" ``` 3. Keep both controls: - Bash validation ensures invalid values are rejected early. - Parsing `sys.argv[1]` with `int()` ensures Python treats the value as data rather than executable source. 4. Add regression tests using nonnumeric input, Python syntax, quotes, semicolons, newlines, negative values, and excessively large integers. Tests should verify rejection and confirm that no injected command runs. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/nix-run.sh:10

Finding

Execution of Remotely Retrieved Packages from an Unpinned Moving Branch

Content

View full analysis

Remediation

View remediation

" ``` 2. Prefer a checked-in `flake.lock` and ensure normal execution does not update it implicitly. 3. Establish an explicit update process: - Update the pin separately from ordinary Skill execution. - Review the revision change. - Run security and functional tests. - Record the approved package-set revision. 4. Restrict `--pkg` and `--shell` package selection to an allowlist when the deployment does not require arbitrary packages. 5. Use trusted Nix substituters with signature verification enabled, and avoid adding arbitrary binary caches or public keys at runtime. 6. Where practical, run downloaded tools in a sandbox with only the required workspace paths, environment variables, and network access available. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:10

Finding

Overbroad Skill Instructions Redirect All CLI Execution Through the Wrapper

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill clearly directs the agent to execute shell commands, including arbitrary user-specified commands, but does not declare any explicit tool scope or allowed-tools constraints. That mismatch can cause the skill to be invoked with broader shell capability than reviewers or enforcement systems expect, increasing the chance of ungoverned command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to execute any command via Nix and to use the skill proactively before running CLI tools, which makes the activation trigger extremely broad. Overbroad activation increases the odds that the agent routes routine requests through a shell/package-fetching path unnecessarily, expanding attack surface and causing unintended code execution behaviors.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

The rule set uses absolute language like 'ALWAYS' and 'NEVER suggest the user install anything' to steer the agent into a single execution path and suppress safer alternatives. This is a behavior-shaping pattern that can override normal caution, making the agent more likely to execute commands through the wrapper even when human review, local tools, or non-execution guidance would be safer.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

1. **ALWAYS run CLI tools through `scripts/nix-run.sh`** — even if you think the tool might already be installed. The script checks locally first (zero overhead) and auto-fetches via nix only if missing.
2. **NEVER install packages** via `apt`, `brew`, `pip install`, `npm install -g`, `cargo install`, or any other package manager. This system uses nix exclusively.
3. **NEVER suggest the user install anything.** Just run it through nix-run.
4. **NEVER use `nix shell` or `nix run` directly.** Always go through `scripts/nix-run.sh` which handles package detection automatically. For multi-package environments, use `--shell`.
5. **On "command not found"**: Do NOT advise installation. Immediately retry through `scripts/nix-run.sh`.
6. **When unsure which tool to use**: Use `--search` to discover the right package, then run it.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

Advertising 'Run ANY command' is effectively unrestricted shell access, and the skill further supports auto-resolving and executing packages from nixpkgs. In an agent setting, unrestricted command execution combined with package fetching creates a strong path to arbitrary code execution, data exfiltration, or destructive system actions if user input or downstream content is malicious.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Quick Start

bash

# Run ANY command — auto-detects package, zero config
scripts/nix-run.sh <command> [args...]

# Multi-package environment — run command with multiple tools available

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to always prefer nix-run for any CLI tool establishes an ambiguous default that pushes all command execution through a dynamic package resolution wrapper. In this context, that is dangerous because it normalizes arbitrary shell execution and remote package retrieval even when not necessary, magnifying the consequences of prompt injection or mistaken tool choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code performs subprocess execution via exec nix shell ... -c using user-provided package and command inputs, which is a safety-relevant operation for code files. While the script prints informational messages in some paths, it does not consistently disclose the risk of executing arbitrary commands or opening an environment that will immediately run the supplied command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script resolves and executes packages from a remote flake reference (nixpkgs-unstable) and may contact network resources without an explicit trust or provenance warning. In an agent setting, this increases supply-chain and unexpected-network-risk exposure because a user may believe the tool only uses local packages while it actually fetches and runs remote package definitions/binaries.

Content

No source excerpt is available for this finding.