tensorlake

• Outcome: Review
• Latest audit: Jun 16, 2026 · 2:35 AM UTC
• Version: 2.9.0

Overview

This Tensorlake skill is mostly coherent, but it needs review because it can trigger broadly and recommends a pipe-to-shell CLI installer.

Install only if you specifically want Tensorlake guidance. Review or avoid the pipe-to-shell CLI installer unless you trust the source and can verify it, and be careful before letting an agent automatically run generated code, expose ports, reuse persistent sandboxes, or send sensitive documents and credentials through the service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill’s activation criteria are extremely broad, covering generic software engineering, agent-building, browser automation, and sandbox use cases. This can cause the skill to trigger for many unrelated requests, increasing the chance that the agent follows Tensorlake-specific instructions or external-fetch behavior in contexts where the user did not ask for it.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger conditions are intentionally broad enough to activate on generic 'sandbox' and related infrastructure requests, not just explicit Tensorlake mentions. In an agent-skill context, this can cause unintended activation and routing of unrelated tasks toward Tensorlake-specific guidance, increasing the chance of incorrect tool selection, unnecessary external fetches, or persuasive vendor-biased instructions being applied where they do not belong.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are extremely broad, including general app-building, coding agents, browser automation, SSH, remote-dev, and sandbox use cases. This can cause the skill to activate in many loosely related contexts, increasing the chance the agent follows its mandatory external-fetch workflow or operational guidance when the user did not specifically request Tensorlake, expanding attack surface and causing unintended tool use.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This example exposes a tool that directly executes arbitrary Python passed as a string, but it does not warn that the input may come from an LLM or end user and therefore must be treated as untrusted. In an agent setting, this omission can lead developers to wire model-generated code into automatic execution, enabling destructive actions, data exfiltration from the sandbox, or abuse of any allowed network/filesystem capabilities.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The persistent sandbox example preserves files and interpreter-visible state across calls, but the documentation does not warn that later tool invocations can read or modify artifacts from earlier ones. In an agent workflow, this increases the risk of cross-turn data leakage, persistence of malicious tooling, poisoned state, and accidental reuse of sensitive uploaded content.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This tool-use loop automatically executes Python requested by the model without any human approval, policy enforcement, or warning to the reader. That is dangerous because an LLM can be induced by prompt injection or malformed context to generate code that exfiltrates data, makes network calls, consumes resources, or performs unintended actions inside the sandbox.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The multi-agent pipeline has one model generate code and another function execute it, but the example lacks any warning that generated code is untrusted. In this context, chaining planning, coding, and execution makes unsafe automation more likely, and prompt injection or model error can directly lead to harmful execution with whatever permissions the sandbox has.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The troubleshooting guide instructs users to send documents via `file_id`/`file_url` and receive status via webhooks, but it omits basic privacy and data-handling cautions such as avoiding public URLs for sensitive files, validating webhook authenticity, and understanding retention/access controls. In a production guide for document ingestion, this omission can lead users to expose confidential documents or trust spoofed completion notifications, especially because the feature is explicitly designed to move user-supplied content across network boundaries.

External Script Fetching

High

• Category: Supply Chain

Content

1. **SDK installed?** If not, install by:
   **Python:** `pip install tensorlake`
   **TypeScript:** `npm install tensorlake`
   **CLI:** `curl -fsSL https://tensorlake.ai/install | sh`
2. **API key set?**
   For using CLI only, run `tl login`.
   For using SDKs, get a key at [cloud.tensorlake.ai](https://cloud.tensorlake.ai) and `export TENSORLAKE_API_KEY=your-api-key-here`.

• Confidence: 98% confidence
• Finding: The skill recommends installing the CLI via a shell pipeline that downloads and immediately executes a remote script. This is dangerous because it bypasses inspection and integrity verification, and in an agent context could lead users to run unreviewed code from the network with the privileges of their shell.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.