Nirvana Plugin

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:09 AM UTC
• Version: 1.0.0

Overview

The skill promises private local inference, but its implementation can send raw user queries or unstripped context to cloud services despite saying private data never leaves.

Review before installing. Use only in local-only mode unless you are comfortable with cloud providers receiving some request content, because the current implementation does not reliably sanitize user queries before cloud calls. Bind Docker services to localhost, avoid the provided latest-tag images in production, use unique service credentials, and do not rely on the stated zero-leak privacy guarantee for regulated or highly sensitive work.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: src/index.js:103

Finding

Unsanitized user queries can be transmitted to cloud providers

Content

View full analysis

text.toLowerCase().includes(kw)); } ``` ### Technical Analysis The context stripper is applied only to the `context` argument. The original user-controlled `query` is passed unchanged to `executeCloud()` and then to `openclaw.query()`. Consequently, credentials, personal information, proprietary source code, medical information, financial records, or document content embedded directly in a query are not redacted. This contradicts the documentation's claim that the user's actual questions and secrets never leave the local system. The privacy-routing heuristic does not provide an adequate compensating control. It detects only five broad substrings and does not inspect common secret formats, personal identifiers, access tokens, private keys, source code, or attached document content. The heuristic also cannot prove that a query is safe for external disclosure. ### Attack Path 1. A user submits a complex query containing private informa ...[truncated 1160 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/context-stripper.js:31

Finding

Missing runtime defaults can disable context stripping and expose full agent context

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/ollama-manager.js:223

Finding

Arbitrary plaintext inference endpoints can receive full local prompts

Content

View full analysis

{ const url = new URL(this.endpoint); const reqOptions = { hostname: url.hostname, port: url.port, path, method, headers: { 'Content-Type': 'application/json' }, timeout: options.timeout || 30000 }; const req = http.request(reqOptions, (res) => { let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { if (res.statusCode >= 200 && res.statusCode < 300) { try { const parsed = JSON.parse(data); resolve(parsed); } catch (e) { resolve(data); // Return raw if not JSON } } else { reject(new Error(`HTTP ${res.statusCode}: ${data}`)); } }); }); req.on('error', reject); req.on('timeout', () => { req.destroy(); reject(new Error('Request timeout')); }); if (body) { req.write(JSON.stringify(body)); } req.end(); }); } ``` ### Technical Analysis The schema accepts any HTTP or HTTPS URL without restricting the hostname to localhost, the expected Docker service, or an approved private inference host. A configuration change can therefore redirect requests classified as “local” to an attacker-controlled server or an internal network target. The implementation always invokes Node.js `http.request`, even if the configured endpoint begins with `https://`. Because the protocol is not included ...[truncated 1659 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:15

Finding

Installation instructions expose unauthenticated services and use mutable container images

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (36)

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Passing /dev/kfd into the container grants direct access to host GPU-related device interfaces. Device passthrough reduces isolation and increases the blast radius if the container image or workload is compromised, especially when combined with mutable image references.

Content

Scanner excerpt · INSTALL.md (reported line 229)May include surrounding context.

bash

docker run -d \
  --device /dev/kfd \
  --device /dev/dri \
  --group-add video \
  ollama/ollama:rocm

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Passing /dev/dri into the container exposes host graphics device interfaces to the workload. While common for GPU acceleration, it meaningfully weakens container isolation and can increase the risk of host impact if the containerized software is vulnerable or malicious.

Content

Scanner excerpt · INSTALL.md (reported line 230)May include surrounding context.

bash

docker run -d \
  --device /dev/kfd \
  --device /dev/dri \
  --group-add video \
  ollama/ollama:rocm

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document provides instructions to disable privacy enforcement with only a mild 'Not Recommended' note, but no clear statement that this can allow sensitive context to cross intended privacy boundaries. Because the plugin's core value proposition is privacy protection, presenting this as a simple config toggle materially increases the chance of accidental data leakage.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · MIGRATION.md (reported line 39)May include surrounding context.

cp memory/audit.log archive/cloud-era/$(date +%Y%m%d)/

Start fresh Nirvana logs

rm memory/nirvana-metrics.json memory/nirvana-audit.log

text

### Migrate Cached Responses

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the implementation only registers providers/models while lacking the promised local/cloud routing and privacy controls, then the core security claims are unsupported. The danger is less from a direct exploit primitive and more from deceptive or overstated assurances that could lead users to send sensitive workloads under false assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

If the implementation only registers providers/models while lacking the promised local/cloud routing and privacy controls, then the core security claims are unsupported. The danger is less from a direct exploit primitive and more from deceptive or overstated assurances that could lead users to send sensitive workloads under false assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the implementation only registers providers/models while lacking the promised local/cloud routing and privacy controls, then the core security claims are unsupported. The danger is less from a direct exploit primitive and more from deceptive or overstated assurances that could lead users to send sensitive workloads under false assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the implementation only registers providers/models while lacking the promised local/cloud routing and privacy controls, then the core security claims are unsupported. The danger is less from a direct exploit primitive and more from deceptive or overstated assurances that could lead users to send sensitive workloads under false assumptions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The install command runs the ollama/ollama image without a version tag or immutable digest, so users will pull whatever image is current at install time. This creates a supply-chain integrity risk because behavior can change unexpectedly or a compromised upstream image could be distributed without users noticing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide instructs users to enable cloud fallback but does not clearly warn that prompts and possibly contextual data may be transmitted to a third-party model provider. In a plugin marketed as privacy-first, this omission is especially risky because users may assume local-only handling and unintentionally expose sensitive data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · INSTALL.md (reported line 138)May include surrounding context.

docker-compose ps

Check Ollama health

curl http://localhost:11434/api/tags

text

## Verify Installation

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The AMD GPU example uses ollama/ollama:rocm without an immutable digest, which leaves installations dependent on a mutable upstream tag. A changed or malicious image could be silently pulled later, affecting hosts with direct device access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The migration guide instructs users to delete metrics and audit logs to 'start fresh' without a prominent warning about irreversible data loss or compliance implications. Operators may erase forensic history, privacy incident evidence, or records needed for troubleshooting and audits.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide makes absolute privacy claims such as identity 'stays local' and is 'never exported' while the same document configures cloud fallback providers. This can mislead operators into believing no sensitive context will ever leave the system, causing unsafe deployment decisions and accidental third-party disclosure when fallback routing occurs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The success criterion 'Zero identity files exported to third parties' conflicts with the documented hybrid deployment that includes cloud fallback. Even if files are not directly uploaded, users may interpret this as a guarantee of zero third-party exposure and fail to account for identity-bearing prompts, metadata, or context sent to external models.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README strongly markets 'Zero privacy leak' and 'Cloud never sees your private data' but does not present a clear, prominent warning that some queries are still transmitted to third-party cloud APIs during fallback. Even if sanitized, this can create a dangerous mismatch between user expectations and actual data flow, causing users to expose sensitive prompts in environments where any external transmission is unacceptable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises that cloud responses are 'cached locally' but does not clearly warn that this may persist sensitive derived content on disk, potentially accessible to other local users, backups, forensic tools, or malware. Because the plugin is positioned for private workloads such as healthcare, legal, and finance, undisclosed local retention materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run the floating image reference ollama/ollama without a tag or digest, which makes the installation non-reproducible and exposes users to unexpected upstream image changes or a compromised latest image. In a security-sensitive, privacy-focused plugin, this is especially risky because users are being asked to trust a local inference boundary, and a silently changed container could undermine that boundary.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises networked behavior such as cloud fallback, GitHub links, Docker/Ollama connectivity, and configurable local endpoints, but it declares no explicit tool scope or permissions. In an agent ecosystem, missing permission boundaries can cause undeclared network access to occur without clear user consent or policy enforcement, undermining the privacy-first claims.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation strongly emphasizes that private data never leaves the system, yet local-first mode can still send sanitized queries to third-party cloud providers. Without a clear warning at the point of use, users may misunderstand the trust boundary and inadvertently allow sensitive derived information to be transmitted externally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 81% confidence

Finding

The installation instructions use an unpinned container image reference (ollama/ollama) rather than a fixed tag or digest. This creates a supply-chain risk because future pulls may retrieve changed or compromised images, making installs non-reproducible and potentially exposing users to malicious code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Cached cloud responses and audit logs may contain sensitive derived content, model outputs, or metadata that reveal user interests, tasks, or partial context. Failing to warn users about local persistence risks is especially problematic for a privacy-focused skill, because users may assume no sensitive artifacts are stored.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The schema enables cloud fallback by default and lists cloud models, but it does not define strict trigger conditions, exclusion rules, or guarantees about what data categories may never be sent during fallback. In a privacy-focused agent plugin, ambiguous fallback behavior can cause sensitive prompts or context to be exported unexpectedly, especially if local inference fails or confidence scoring is misapplied.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest repeatedly advertises 'cloud fallback optional' and cloud-capable routing, but it does not define when data may leave the local environment, what signals trigger fallback, or what content is eligible for remote transmission. In a privacy-oriented agent plugin, that ambiguity is security-relevant because sensitive prompts, memory, or identity-bearing context could be sent to a cloud provider unexpectedly or under overly broad conditions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This manifest requests broad capabilities: reading sensitive agent state files, writing memory and session state, executing docker and an Ollama API path, and performing cloud-capable routing, yet it lacks an explicit user warning or consent boundary describing these risks. In combination, these permissions could enable exfiltration of sensitive context, persistence of manipulated state, and host-level side effects through container management, making the plugin materially more dangerous than a typical local-only skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.