nirvana
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The bootstrap scripts download and execute the Bun installer from a well-known service (bun.sh) using piped shell commands (curl|bash and irm|iex).
- [REMOTE_CODE_EXECUTION]: The skill downloads the Nirvana-OS engine tarball from the vendor's GitHub repository (github.com/gutomec) and executes an internal TypeScript installer using the Bun runtime.
- [REMOTE_CODE_EXECUTION]: The scripts include a fallback mechanism that uses npx to download and execute the @nirvana-os/cli package from the official registry if Bun is unavailable.
- [PERSISTENCE]: The installation process modifies user shell profiles (e.g., .bashrc, .zshrc) to add the engine's binary directory to the system PATH.
- [PERSISTENCE]: The skill modifies configuration directories of other AI agent runtimes (such as .claude, .gemini, .codex, and .antigravity) to install audit hooks, which is consistent with its intended purpose as a cross-agent operating system.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted output from CLI commands and reads external instruction files, creating a potential surface for indirect prompt injection.
- Ingestion points: nrv command output and engine-internal SKILL.md files.
- Boundary markers: None explicitly defined for command output interpolation.
- Capability inventory: The skill has access to Bash and Read tools to execute subsequent actions.
- Sanitization: No explicit sanitization or filtering is applied to the ingested external content.
- [COMMAND_EXECUTION]: The skill makes extensive use of the shell tool to run nrv CLI commands for discovery, inspection, and production tasks.
Recommendations
- HIGH: Downloads and executes remote code from: https://bun.sh/install - DO NOT USE without thorough review
Audit Metadata