mlx-local-inference

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:53 PM UTC
• Version: 2.2.1

Overview

The skill mostly fits local AI inference, but its setup and examples ask users or agents to run unverified mutable code and local service-management commands with too little scoping.

Review this skill before installing. Use it only if you are comfortable running local Python and service commands on your Mac. Install uv through a verified channel, pin or lock MLX dependencies where possible, run inference with only the needed files accessible, and require explicit confirmation before any service restart.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:141
• Finding: Unverified Remote Installer Executed Through a Shell Pipeline<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 141 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instruction streams a remotely hosted script directly into `sh`. The script is not pinned to a specific immutable version, saved for inspection, or validated using a cryptographic checksum or signature before execution. HTTPS protects the script while in transit but does not ensure that the content hosted at the URL remains safe or unchanged. Compromise of the remote hosting environment, publication process, DNS/TLS trust chain, or installer account could cause arbitrary attacker-controlled shell commands to be executed. Installing `uv` is relevant to the documented inference workflows, but executing a mutable remote script is not the minimum capability necessary. The Skill metadata already declares `uv` as a prerequisite, so installation can be handled separately through a verified distribution channel. ### Attack Path 1. An attacker compromises the remote installer host, its release process, or another component of the delivery chain. 2. The attacker replaces or modifies `install.sh` with malicious shell commands. 3. A user follows the documented installation instruction. 4. `curl` retrieves the modified script and streams it directly to `sh`. 5. The malicious commands execute with the privileges of the user running the command. 6. The payload can access or modify resources available to that user and may install additional components. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. This may allow access to user-readable documents, source code, model files, credentials, shell configuration, and other local data. It may also permit modification of user-owned files or installation of user-level persistence. Th ...[truncated 267 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | sh` pipeline from the Skill. 2. Treat `uv` strictly as a prerequisite and direct users to an independently verified installation process. 3. Prefer a trusted operating-system package manager or an official, version-pinned release artifact. 4. If manual installation is required: - Download a specific release to a local file. - Verify its cryptographic checksum or signature against a value obtained through an independent trusted channel. - Allow the user to inspect the downloaded content. - Execute it only after verification. 5. Pin the installer or binary to an explicit version rather than retrieving mutable content from a generic installation URL. 6. Document that installation should occur without elevated privileges unless elevation is demonstrably necessary. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62
• Finding: Unpinned Python Dependencies Are Downloaded and Executed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 62–101 **Vulnerability Type**: Insecure dependency resolution and runtime execution **Risk Level**: Medium ### Vulnerable Code Embedding command beginning at line 62: ```bash uv run --with mlx-lm python -c " from mlx_lm import load model, tokenizer = load('~/models/Qwen3-Embedding-0.6B-4bit-DWQ') text = 'text to embed' inputs = tokenizer(text, return_tensors='np') embeddings = model(**inputs).last_hidden_state.mean(axis=1) print(embeddings.shape) " ``` ASR command beginning at line 78: ```bash uv run --python 3.11 --with mlx-audio python -m mlx_audio.stt.generate \ --model ~/models/Qwen3-ASR-1.7B-8bit \ --audio "audio.wav" \ --output-path /tmp/asr_result \ --format txt \ --language zh \ --verbose ``` OCR script and dependency execution ending at line 101: ```bash cat << 'PY_EOF' > run_ocr.py import os from mlx_vlm import load, generate from mlx_vlm.prompt_utils import apply_chat_template model_path = os.path.expanduser("~/models/PaddleOCR-VL-1.5-6bit") model, processor = load(model_path) prompt = apply_chat_template(processor, config=model.config, prompt="OCR:", num_images=1) output = generate(model, processor, prompt, "document.jpg", max_tokens=512, temp=0.0) print(output.text) PY_EOF uv run --python 3.11 --with mlx-vlm python run_ocr.py ``` ### Technical Analysis The `uv run --with` commands resolve and execute `mlx-lm`, `mlx-audio`, and `mlx-vlm` without explicit versions, hashes, or a committed lockfile. Consequently, the code executed by these examples can change even when `SKILL.md` remains unchanged. The audit found no evidence that the named packages are currently malicious. The risk arises from mutable and unconstrained dependency resolution. A compromised package release, compromised transitive dependency, or unexpectedly incompatible future release could execute code with the same permissions as the user. Because the packages process local models, audio, ...[truncated 1304 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `mlx-lm`, `mlx-audio`, and `mlx-vlm` to explicitly reviewed versions. 2. Define dependencies in a project configuration and commit the generated `uv.lock` file. 3. Run the examples with locked or frozen dependency resolution, such as `uv run --locked`, rather than resolving current package releases each time. 4. Enable hash or signature verification where supported. 5. Review and lock transitive dependencies, not only the three top-level packages. 6. Perform dependency updates through a controlled review process that checks release provenance and security advisories. 7. Run inference in a restricted environment with only the required input files mounted or accessible. 8. Disable unnecessary outbound network access during inference so that a compromised dependency cannot readily transmit local documents or audio. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Check running models
curl http://localhost:8000/v1/models

# Restart oMLX
launchctl kickstart -k gui/$(id -u)/com.omlx-server

• Confidence: 74% confidence
• Finding: The snippet combines benign local inspection with a forceful service restart command, introducing a capability that can alter host behavior beyond inference tasks. In an automated-agent setting, exposing operational shell commands without strong scoping can enable parameter misuse or unintended disruption if the agent executes maintenance actions without explicit approval.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The speech-to-text example hard-codes `--language zh`, imposing a specific language/locale choice in natural-language-facing behavior. The file does not indicate that this is optional, user-selected, or required for a region-specific use case, which conflicts with the language/locale policy guidance.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes a host-management command that restarts a user LaunchAgent, which exceeds the narrow scope of model inference and changes local system state. In an agent context, this could cause unwanted service disruption or be repurposed to manipulate local services without clear user intent, especially because it embeds shell substitution via $(id -u).

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The manifest description emphasizes local, offline inference as an alternative to cloud APIs, which suggests no network dependency for use. However, the documented requirement installs `uv` via a remote `curl` pipeline, meaning the skill as documented does rely on network access for setup even if inference itself is local.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The OCR example uses a heredoc to create `run_ocr.py`, which performs a file write in the current directory. In this markdown file, there is no user-facing warning that the example will create or overwrite a local file, which is a data-affecting behavior covered by missing-warning checks for markdown.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# Check running models
curl http://localhost:8000/v1/models

# Restart oMLX
launchctl kickstart -k gui/$(id -u)/com.omlx-server

• Confidence: 15% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Static analysis

No suspicious patterns detected.