nika
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation and use of the
nikaCLI tool and official templates from the vendor's repository (supernovae-st/tap/nika). The instructions emphasize that installation is a manual step performed by the user. - [COMMAND_EXECUTION]: The skill utilizes the
terminaltool to orchestrate workflows. It incorporates best practices for command execution, such as usingnika checkfor static analysis before execution and enforcing budget caps with--max-cost-usd. - [INDIRECT_PROMPT_INJECTION]: The skill processes
*.nika.yamlfiles which can ingest external data from URLs or shell outputs. This risk is managed by the tool's architecture, which includes ingestion point tracking, mandatory boundary checks vianika check, and a strict capability inventory (permits) that prevents unauthorized tool or network invocation.
Audit Metadata