Nia

Index and search code repositories, documentation, research papers, HuggingFace datasets, local folders, and packages with Nia AI. Includes Oracle autonomous research, dependency analysis, context sharing, and code advisor.

This skill appears to implement the advertised Nia indexing/search features, but pay attention before installing or running it: - The scripts expect a Nia API key stored at ~/.config/nia/api_key and will read it automatically; the registry metadata does not declare this — verify you trust trynia.ai before adding your key.\n - Many commands (folders create/sync, deps upload, advisor with files, from-db, etc.) will read local files or accept DB connection strings and send their contents to the remote API (https://apigcp.trynia.ai/v2). Do not index or upload secrets, private keys, credentials, or sensitive directories (home, /.ssh, etc.).\n - The skill lets you share conversation contexts across agents — that can leak confidential chat history if used without limits.\n - If you plan to let an autonomous agent invoke this skill, restrict what the agent can do: avoid granting it access to sensitive local folders or database credentials, or disable autonomous invocation for this skill in your agent policy if possible.\n - Recommended steps before use: (1) Confirm the homepage and API host are the official provider you expect; (2) create a dedicated, limited-scope API key on trynia.ai (if supported) rather than using a broad key; (3) review and avoid running folder/index commands on sensitive paths; (4) prefer manual invocation and inspect commands before running.\n - The main metadata omission (undeclared config path / credential) is an incoherence — ask the publisher to declare required credentials and config paths in the registry entry before trusting automated workflows.

Type: OpenClaw Skill Name: nia Version: 1.0.3 The skill is classified as suspicious due to several high-risk capabilities that, while aligned with its stated purpose of indexing and searching, could be easily abused for data exfiltration. Specifically, `scripts/folders.sh` contains functions (`_scan_folder`, `cmd_from_db`, `cmd_preview_db`) that allow reading arbitrary local text files and executing arbitrary SQL queries against accessible databases, then uploading the content/results to the remote API endpoint `https://apigcp.trynia.ai/v2`. While there is no clear evidence of intentional malicious behavior or prompt injection attempts in the `SKILL.md` to subvert the agent, these broad file and database access permissions represent a significant security risk if the agent were to be compromised or misused.