Security audit

Langextract

Security checks across malware telemetry and agentic risk

Overview

This LangExtract helper is coherent, but it under-warns users about sending sensitive documents to model providers, saving sensitive outputs, handling API keys, and running a remote installer script.

Install only after reviewing the commands and data flow. Use a secret manager or protected environment variables for API keys, keep .env and generated JSONL/HTML files out of version control, avoid real medical/legal/confidential data unless your provider and environment are approved, prefer local Ollama for private documents, and inspect remote installer scripts before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly encourages processing document URLs and generating local JSONL/HTML outputs, but it does not warn the agent or user that these actions may trigger outbound network requests and filesystem writes. In an agent setting, this can cause unintended data exfiltration, retrieval of attacker-controlled remote content, or creation of files in sensitive locations without explicit user consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide instructs users to append a live API key to a local .env file but does not warn that such files are commonly leaked via source control, backups, notebook sharing, or permissive filesystem access. This is a real secret-handling weakness because the documentation normalizes storing credentials in a recoverable plaintext file without any accompanying protection guidance.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The documentation recommends piping a remotely fetched installer script directly into sh, which executes unreviewed network content immediately. If the download source, DNS, TLS trust chain, or hosting account is compromised, users may run attacker-controlled code on their machine.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The medical-text example processes and prints structured data from clinical notes, which can contain protected health information and other sensitive personal data. In a quickstart guide, omitting a privacy warning and redaction guidance can lead users to test with real patient notes and expose that data in logs, terminals, notebooks, or downstream systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide instructs users to save extraction outputs to JSONL and HTML without noting that these artifacts may contain source text, offsets, and extracted entities, which can persist sensitive information on disk. This creates a realistic risk of accidental disclosure through shared workspaces, source control, backups, or insecure file handling.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The URL example implies that passing a URL causes the library to fetch remote content, but it does not clearly warn about the network access, trust boundary, or the fact that document contents will be retrieved from an external location. Users may unintentionally access untrusted or sensitive endpoints, with potential privacy, compliance, or SSRF-like concerns depending on runtime environment.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.