Security audit

Li PhotoIndexWithLLM

Security checks across malware telemetry and agentic risk

Overview

This photo-search skill does sensitive photo indexing, but the reviewed code and documentation mostly disclose the behavior and keep remote upload disabled unless configured.

Install only if you are comfortable creating a local searchable database of your photo paths and generated descriptions. Keep the default local-only privacy mode for sensitive photos, protect any .env and database files, and enable remote models only when you explicitly accept that image content may be sent to the configured provider.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation presents the skill as a 'completely independent program' while also stating it automatically discovers the main project's .env file and shares the main database. That mismatch can mislead users and integrators into granting broader trust than warranted, obscuring that the skill may read local configuration and operate on shared state.

Intent-Code Divergence

Low

Confidence: 86% confidence
Finding: Claiming that all code is self-contained in skill.py while describing behavior that depends on external files creates a misleading security model. Users may assume no interaction with surrounding project assets, when in fact configuration and shared database files can influence execution and data exposure.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document describes remote-upload confirmation and local-only defaults as necessary protections, but elsewhere indicates these controls are still unchecked and therefore not implemented. This creates a real security gap because users may assume photo uploads are protected by consent and local-only behavior when sensitive images can still be sent to third-party services without those safeguards.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The usage guidance describes scanning photo directories and optionally loading the main project's .env without warning that local files and configuration data may be accessed. In an agent skill context, this increases the risk of unintended collection of sensitive filesystem contents or secrets because operators are not clearly informed of those behaviors.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill is explicitly designed to scan, index, annotate, and train on user photo collections, which are often highly sensitive personal data. The documentation does not warn that these operations may create persistent local indexes or metadata and may process private images, increasing the risk of unintentional privacy exposure or user surprise.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The documentation states that local or remote VL models may be used, and the configuration includes a remote API key/model, but it does not warn that image content or derived metadata could be transmitted off-device. For a photo-processing skill, this omission is significant because personal photos may contain faces, locations, documents, or other sensitive content.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.