nika

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the installation and use of the nika CLI tool and official templates from the vendor's repository (supernovae-st/tap/nika). The instructions emphasize that installation is a manual step performed by the user.
  • [COMMAND_EXECUTION]: The skill utilizes the terminal tool to orchestrate workflows. It incorporates best practices for command execution, such as using nika check for static analysis before execution and enforcing budget caps with --max-cost-usd.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes *.nika.yaml files which can ingest external data from URLs or shell outputs. This risk is managed by the tool's architecture, which includes ingestion point tracking, mandatory boundary checks via nika check, and a strict capability inventory (permits) that prevents unauthorized tool or network invocation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 08:26 PM