Security audit

Photo Index With LLM

Security checks across malware telemetry and agentic risk

Overview

This photo indexing skill handles sensitive photos, but its file access, local database, and optional remote model use are mostly disclosed and fit its stated purpose.

Install only if you are comfortable indexing the photo folders you choose. Prefer local-only mode for personal photos, protect the .env and SQLite database files, and enable remote model analysis only when you understand that full images may be sent to the configured provider.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document states that remote photo upload should be disabled by default and require explicit user confirmation, but the checklist indicates these protections are not yet implemented. In this skill context, the data involved is user photos, so missing these controls can lead to unintended transmission of sensitive images to third-party services.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The document makes an absolute claim of 'no external data transmission' while also describing use of remote models with user confirmation. This inconsistency can mislead users and reviewers about privacy and data-flow behavior, causing sensitive photo metadata or content to be sent off-device under assumptions that no transmission occurs.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The checklist asserts there is no external data collection, but earlier text acknowledges optional remote transmission to remote models. Even if the transfer is user-approved, contradictory assurances create a deceptive privacy posture and increase the risk that users enable remote features without understanding the exposure of image data or derived metadata.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill automatically searches for and reads project-level .env files, which commonly contain API keys and other secrets unrelated to the photo-search function itself. In an agent-skill context, broad secret discovery materially increases the blast radius because the skill can inherit credentials from parent directories without explicit user consent.

Context-Inappropriate Capability

High

Confidence: 89% confidence
Finding: The configuration enables remote LLM use and includes fields for remote endpoint and API key, creating a built-in path for sending photo content to a third-party service. Even if framed as a feature, this is sensitive data exfiltration capability because photos may contain personal or confidential information and the remote service is outside the local trust boundary.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code reads the full image, base64-encodes it, and embeds it in a request sent to the remote chat completion endpoint. This transmits complete photo contents rather than derived metadata, so any sensitive visual data is exposed to the remote provider and potentially logged, retained, or reused depending on provider policy.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The document explicitly states the skill will automatically search for and load the main project's .env file, but provides no warning, consent flow, or scoping details. In a skill context, implicit access to configuration files can expose API keys, database paths, or other sensitive settings and can surprise users who expect the skill to be self-contained.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly scans, indexes, and semantically analyzes photos, which can include highly sensitive personal content, faces, locations, timestamps, and embedded metadata. The documentation encourages use by agents and mentions local/remote VL models, but provides no privacy warning or consent guidance, increasing the chance that users unknowingly send personal image data to models or process third-party images without notice.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The configuration section documents remote LLM use and API key settings, but does not warn that photos, descriptions, or metadata may be transmitted to external providers or that credentials must be protected. In a photo-analysis skill, this omission is security-relevant because users may expose sensitive images to third parties and mishandle secrets without understanding the trust boundary.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.