Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nia
v1.0.3Index and search code repositories, documentation, research papers, HuggingFace datasets, local folders, and packages with Nia AI. Includes Oracle autonomous research, dependency analysis, context sharing, and code advisor.
⭐ 0· 2.5k·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The scripts (repos, sources, search, oracle, tracer, folders, advisor, deps, contexts, etc.) implement indexing/searching of repos, docs, papers, datasets, local folders, dependency analysis and an 'Oracle' research flow — which matches the skill name and description.
Instruction Scope
Runtime instructions and provided scripts will read local files and directories (folders.sh _scan_folder) and can upload their full contents, accept DB connection strings and run DB previews/uploads, and save/share conversation contexts. These behaviors are consistent with the feature set but expand the scope to potentially exfiltrate arbitrary local data to https://apigcp.trynia.ai/v2 if misused or invoked without careful limits; SKILL.md does not prominently warn about sensitive-data risks.
Install Mechanism
No install spec or remote download; this is an instruction+script bundle included in the skill. No installers or remote archives are fetched by the package itself (lower install risk).
Credentials
The registry metadata claims no required env/config, but SKILL.md + scripts require an API key stored in ~/.config/nia/api_key (lib.sh reads it on source). That credential/config-path requirement is not declared in metadata (and 'required config paths' is empty), which is an inconsistency. The scripts also accept optional DB connection strings, files to upload, and many optional env vars for behavior — these are plausible for the stated purpose but increase sensitivity because secrets and local data may be sent to the provider.
Persistence & Privilege
The skill is not always-included, does not request elevated platform privileges, and does not modify other skills or system-wide settings. Note: lib.sh auto-initializes auth on source which causes the scripts to read the API key file when any script is run.
What to consider before installing
This skill appears to implement the advertised Nia indexing/search features, but pay attention before installing or running it:
- The scripts expect a Nia API key stored at ~/.config/nia/api_key and will read it automatically; the registry metadata does not declare this — verify you trust trynia.ai before adding your key.\n
- Many commands (folders create/sync, deps upload, advisor with files, from-db, etc.) will read local files or accept DB connection strings and send their contents to the remote API (https://apigcp.trynia.ai/v2). Do not index or upload secrets, private keys, credentials, or sensitive directories (home, /.ssh, etc.).\n
- The skill lets you share conversation contexts across agents — that can leak confidential chat history if used without limits.\n
- If you plan to let an autonomous agent invoke this skill, restrict what the agent can do: avoid granting it access to sensitive local folders or database credentials, or disable autonomous invocation for this skill in your agent policy if possible.\n
- Recommended steps before use: (1) Confirm the homepage and API host are the official provider you expect; (2) create a dedicated, limited-scope API key on trynia.ai (if supported) rather than using a broad key; (3) review and avoid running folder/index commands on sensitive paths; (4) prefer manual invocation and inspect commands before running.\n
- The main metadata omission (undeclared config path / credential) is an incoherence — ask the publisher to declare required credentials and config paths in the registry entry before trusting automated workflows.Like a lobster shell, security has layers — review code before you run it.
latestvk97bvk2zjpqdjs886s9jemj0gn80rz7j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
