Nyne Deep Research

Research any person using the Nyne Deep Research API. Submit an email, phone, social URL, or name and receive a comprehensive intelligence dossier with psych...

This skill calls an external person-research API and its SKILL.md requires NYNE_API_KEY and NYNE_API_SECRET even though the registry metadata does not declare them—ask the publisher to fix the metadata before installing. Before using: verify the Nyne API provider is legitimate and that you have legal/ethical permission to research the target; avoid using callback_url to send results to third-party endpoints you don't control; do not store API secrets in world-readable files—use a secure secret store or at minimum restrict file permissions (chmod 600) and avoid echoing secrets into shell history; be aware the skill's instructions explicitly instruct showing full, unredacted dossiers (which may include highly sensitive personal data) and consider whether you need that level of detail. If you proceed, request that the registry entry be updated to list required env vars/primary credential and ask for clearer guidance on secure secret handling and safe defaults for webhook usage.

Type: OpenClaw Skill Name: nyne-deep-research Version: 1.0.0 The skill is classified as suspicious due to a significant shell injection vulnerability present in the `SKILL.md` examples. The `curl -d` commands construct JSON payloads by directly concatenating strings, which, if user input for parameters like `email`, `phone`, `social_media_url`, `name`, `company`, `city`, or `callback_url` is not properly sanitized by the agent, could allow arbitrary command execution. Additionally, the `callback_url` parameter, while not explicitly used in the provided examples, represents a potential data exfiltration channel if an agent were prompted to use it with an attacker-controlled URL, allowing the sensitive dossier data to be sent to an unauthorized endpoint by the Nyne API service.