Security audit

Nimmit Onboarding

Security checks across malware telemetry and agentic risk

Overview

This onboarding skill is setup-oriented, but it can silently change workspace files, install unspecified skill packs, and create a recurring briefing from a Telegram chat flow.

Install only if you are comfortable with chat onboarding making persistent workspace changes, enabling extra skill packs, and scheduling a daily briefing. Ask the publisher to add explicit consent, list exact files and skill packs affected, require owner/admin verification, and document how to disable or roll back the setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill presents itself as a simple Telegram onboarding flow, but its documented behavior performs broad local workspace reconfiguration and enables additional capabilities. This mismatch is dangerous because a user or operator may consent to a chat interaction without understanding that files, installed skills, and runtime behavior will be changed behind the scenes.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Directing the agent to use exec to copy or install skill packs introduces command execution during a low-trust onboarding flow. If the installation source, parameters, or selected packs are influenced by user input or weakly validated mappings, this can expand privileges, alter behavior, or enable arbitrary command-side effects well beyond onboarding.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Creating a cron-based recurring task as part of onboarding exceeds the user's immediate chat request and establishes persistent automation. This is risky because it can trigger future actions without clear consent, surprise the user, and create an ongoing execution foothold tied to minimal initial interaction.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Triggering onboarding on a user's 'first message' is overly broad and can cause the skill to activate on arbitrary initial contact rather than a deliberate setup request. In this skill, that broad trigger is more dangerous because activation leads to downstream file writes, skill installation, and scheduled automation rather than a harmless greeting.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill explicitly instructs silent setup that modifies multiple workspace files, installs skill packs, and creates persistent configuration without telling the user. Hidden privileged actions undermine informed consent and make it easier for an innocuous-seeming chat flow to perform impactful state changes that the user never approved or may not detect.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The technical execution section authorizes write, exec, and cron operations while specifically telling the agent not to disclose these technical actions to the user. Combining privileged tools with non-disclosure is especially dangerous because it removes transparency around file mutation, command execution, and recurring automation in response to a simple onboarding conversation.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.