Nirvana Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it handles very private agent context while relying on an unreviewed external install and under-specified logging, caching, and network behavior.

Review the actual shivaclaw/nirvana-local package and pin a known version before installing. Use loopback-only HTTP or HTTPS/authenticated tunneling for remote inference, and verify where audit logs, cached responses, and cloud fallback requests are stored and controlled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:74

Finding

Unpinned External Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74-84
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

# 1. Install skill
clawhub install shivaclaw/nirvana-local

# 2. Configure your local LLM endpoint
openclaw nirvana-local configure \
  --local-endpoint http://localhost:11434 \
  --local-model qwen2.5:7b

# 3. Verify
openclaw nirvana-local status

Technical Analysis

The installation command retrieves the shivaclaw/nirvana-local package from an external package registry without specifying an immutable version, commit, or integrity hash. The reviewed project contains only SKILL.md; it does not include the external package's implementation, so the executable behavior responsible for context stripping, cloud routing, caching, and audit logging could not be reviewed.

A mutable dependency may change after this skill has been audited. If the registry account, package publication process, or distribution infrastructure is compromised, a malicious release could be delivered through the documented command. This is especially sensitive because the installed package is intended to process agent prompts, private context, cloud requests, model responses, configuration, and audit records.

Attack Path

1. An attacker compromises the package publisher, registry account, release pipeline, or package distribution service.
2. The attacker publishes a modified package under shivaclaw/nirvana-local.
3. A user follows the documented installation command, which does not constrain the package to an audited immutable release.
4. The package manager retrieves and installs the attacker-controlled version.
5. When OpenClaw loads or invokes the package, malicious code executes with the permissions granted to the OpenClaw process.
6. The package may read or transmit prompts, private context, model responses, configuration, or other data ...[truncated 557 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an immutable, explicitly reviewed version rather than installing a mutable package reference.
• Where supported, specify and verify a cryptographic integrity hash or signed package manifest.
• Include the implementation source in the audited artifact, or link the installation to a fixed source commit whose contents can be independently reviewed.
• Require signed releases and verify publisher identity before installation.
• Document the permissions, files, environment variables, and network destinations required by the package.
• Run the package with least privilege and restrict filesystem and network access to the minimum necessary.
• Maintain a dependency lock file or equivalent reproducible installation manifest.
• Re-audit the actual installed package whenever its pinned version is updated.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:181

Finding

Remote Local-LLM Example Uses Unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 181-189
Vulnerability Type: Plaintext transmission of model requests and responses
Risk Level: Medium

Vulnerable Code

json

{
  "plugins": {
    "nirvana-local": {
      "local_llm": {
        "endpoint": "http://your-server:5000",
        "model": "your-model",
        "api_format": "custom",
        "custom_api_handler": "llamafile"  // or "vllm", "lm-studio", etc.
      }
    }
  }
}

Technical Analysis

The custom endpoint example uses http://your-server:5000. Unlike a loopback-only endpoint, your-server implies that requests may cross a local or remote network. HTTP does not provide transport encryption, endpoint authentication, or message integrity.

If users copy this configuration for a non-loopback server, a network-positioned attacker may observe prompts and model responses or modify traffic in transit. Because the described component is explicitly responsible for processing potentially private agent tasks, intercepted requests could disclose sensitive task content even when broader context stripping operates as intended.

The artifact contains no implementation code demonstrating that non-loopback plaintext endpoints are rejected, upgraded to HTTPS, or protected through another authenticated transport.

Attack Path

1. A user configures a local inference server on another host using the documented http://your-server:5000 endpoint.
2. Model requests and responses traverse a network without TLS protection.
3. An attacker gains a suitable network position, such as control of an access point, router, proxy, compromised host, or local network segment.
4. The attacker captures plaintext requests and responses or performs a man-in-the-middle attack.
5. The attacker reads sensitive task data or modifies a model response before it reaches the agent.
6. The agent may then expose confidential information or act ...[truncated 454 chars]

Remediation

View remediation

Remediation Suggestions

• Require https:// for every non-loopback model endpoint.
• Reject plaintext HTTP endpoints unless the destination is a verified loopback address or traffic is protected by an authenticated tunnel.
• Validate server certificates and hostnames; do not disable TLS verification.
• Consider mutual TLS or securely managed API authentication for remote inference servers.
• Update the example to use https://your-server:5000 and clearly document certificate setup.
• Add explicit warnings that plaintext HTTP is suitable only for tightly controlled loopback communication.
• Enforce an endpoint allowlist and prevent redirects from HTTPS endpoints to plaintext HTTP.
• Avoid logging full prompts or responses when diagnosing transport errors.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:59