nika
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the 'nika' command-line tool to manage AI workflows.
- [INDIRECT_PROMPT_INJECTION]: The skill processes workflow files and user-defined variables that could potentially contain malicious instructions.
- Ingestion points: Workflow definitions in *.nika.yaml files and variables passed via the --var flag.
- Boundary markers: The skill requires a mandatory 'nika check' step to perform static analysis and secret flow verification before any code execution.
- Capability inventory: The engine can execute shell commands, perform network requests, and access the filesystem, but these are strictly controlled by a 'permits' block that defaults to zero authority.
- Sanitization: Mitigation is provided through static pre-flight checks, type validation, and budget enforcement.
- [DYNAMIC_EXECUTION]: The skill executes logic defined in YAML files, which is mitigated by the enforced audit process and granular permission model.
Audit Metadata