Security audit

mlx-local-inference

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits local AI inference, but its setup and examples ask users or agents to run unverified mutable code and local service-management commands with too little scoping.

Review this skill before installing. Use it only if you are comfortable running local Python and service commands on your Mac. Install uv through a verified channel, pin or lock MLX dependencies where possible, run inference with only the needed files accessible, and require explicit confirmation before any service restart.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:141
Finding: Unverified Remote Installer Executed Through a Shell Pipeline
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:62
Finding: Unpinned Python Dependencies Are Downloaded and Executed at Runtime
Content: View full analysis
run_ocr.py import os from mlx_vlm import load, generate from mlx_vlm.prompt_utils import apply_chat_template model_path = os.path.expanduser("~/models/PaddleOCR-VL-1.5-6bit") model, processor = load(model_path) prompt = apply_chat_template(processor, config=model.config, prompt="OCR:", num_images=1) output = generate(model, processor, prompt, "document.jpg", max_tokens=512, temp=0.0) print(output.text) PY_EOF uv run --python 3.11 --with mlx-vlm python run_ocr.py ``` ### Technical Analysis The `uv run --with` commands resolve and execute `mlx-lm`, `mlx-audio`, and `mlx-vlm` without explicit versions, hashes, or a committed lockfile. Consequently, the code executed by these examples can change even when `SKILL.md` remains unchanged. The audit found no evidence that the named packages are currently malicious. The risk arises from mutable and unconstrained dependency resolution. A compromised package release, compromised transitive dependency, or unexpectedly incompatible future release could execute code with the same permissions as the user. Because the packages process local models, audio, ...[truncated 1304 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 74% confidence
Finding: The snippet combines benign local inspection with a forceful service restart command, introducing a capability that can alter host behavior beyond inference tasks. In an automated-agent setting, exposing operational shell commands without strong scoping can enable parameter misuse or unintended disruption if the agent executes maintenance actions without explicit approval.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
bash
# Check running models curl http://localhost:8000/v1/models # Restart oMLX launchctl kickstart -k gui/$(id -u)/com.omlx-server

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The speech-to-text example hard-codes --language zh, imposing a specific language/locale choice in natural-language-facing behavior. The file does not indicate that this is optional, user-selected, or required for a region-specific use case, which conflicts with the language/locale policy guidance.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill includes a host-management command that restarts a user LaunchAgent, which exceeds the narrow scope of model inference and changes local system state. In an agent context, this could cause unwanted service disruption or be repurposed to manipulate local services without clear user intent, especially because it embeds shell substitution via $(id -u).
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest description emphasizes local, offline inference as an alternative to cloud APIs, which suggests no network dependency for use. However, the documented requirement installs uv via a remote curl pipeline, meaning the skill as documented does rely on network access for setup even if inference itself is local.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The OCR example uses a heredoc to create run_ocr.py, which performs a file write in the current directory. In this markdown file, there is no user-facing warning that the example will create or overwrite a local file, which is a data-affecting behavior covered by missing-warning checks for markdown.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 15% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
bash
# Check running models curl http://localhost:8000/v1/models # Restart oMLX launchctl kickstart -k gui/$(id -u)/com.omlx-server

Static analysis

No suspicious patterns detected.