ai

• Outcome: Review
• Latest audit: May 28, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

The skill mostly behaves like an AI media client, but its Venice privacy branding conflicts with routing credentials and user content through SkillBoss/HeyBoss, so users should review it before use.

Install only if you are comfortable trusting SkillBoss/HeyBoss as well as Venice with your API key, prompts, files, audio, images, and videos. Use a dedicated low-privilege key, avoid regulated or confidential data, be cautious with URL inputs, and assume generated files or metadata may contain prompt details when metadata options are enabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tainted flow: 'req' from os.environ.get (line 231, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

if audio_url:
        # Download audio from returned URL
        req = urllib.request.Request(audio_url, headers={"User-Agent": USER_AGENT})
        audio_resp = urllib.request.urlopen(req, timeout=60)
        audio_data = audio_resp.read()
        out = Path(args.output) if args.output else Path(f"/tmp/venice-tts-{int(dt.datetime.now().timestamp())}.mp3")
        out.write_bytes(audio_data)

• Confidence: 90% confidence
• Finding: The code blindly fetches audio from a URL returned by the remote API without validating scheme, host, or size. If the upstream service is compromised or malicious, this can trigger server-side request forgery style access from the client context, unexpected local-network requests, or large unbounded downloads to disk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises capabilities that involve environment access, file I/O, and network use, but it does not declare permissions accordingly. That weakens user consent and reviewability, making it easier for a skill to access local data and transmit it remotely without clear upfront disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documentation materially misrepresents the backend and behavior, including directing users to a SkillBoss/third-party API path instead of a clearly defined Venice API flow and claiming broader capabilities than are consistently documented. This is dangerous because users may provide credentials and sensitive content under false assumptions about where data goes and what services are actually invoked.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The setup instructions contradict the stated Venice API requirement by telling users to obtain and configure a SkillBoss API key instead. This creates credential confusion, increases the risk of secret mishandling, and obscures which service receives user prompts and files.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The API reference exposes a `scraping` capability that is not reflected in the skill metadata/description. Undocumented capability expansion is risky because reviewers and users may grant trust based on an incomplete understanding of what the skill can do, and web scraping can be used to fetch arbitrary remote content that may include sensitive or policy-relevant data flows.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The script presents itself as using the Venice AI API, but actual requests are routed through SkillBoss API Hub. This is a security-relevant transparency failure because users may provide prompts, media, and API keys under false assumptions about where their data is sent and who can access it. In a privacy-sensitive AI skill, hidden third-party routing materially changes the trust boundary.

Natural-Language Policy Violations

High

• Confidence: 90% confidence
• Finding: The skill explicitly promotes uncensored operation, no refusals, and bypass-like behavior around safety controls. In the context of an agent skill that can send prompts and media to remote services, this increases the likelihood of harmful or policy-violating output generation and reduces built-in safeguards against misuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill encourages sending prompts, URLs, audio, and media to a remote AI service while emphasizing privacy marketing without a precise warning about what data leaves the local environment, under what conditions, and through which processor. That can lead users to expose sensitive data based on incomplete or misleading privacy assumptions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to send base64 audio for transcription and arbitrary URLs for scraping to a third-party API without any warning that sensitive voice content, personal data, or internal URLs may be transmitted off-platform. This creates a meaningful privacy and data-handling risk because users or downstream agents may unknowingly send confidential information to an external service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The --embed-exif flag causes prompt and generation metadata to be embedded into output images, which can leak sensitive user inputs when those images are later shared or uploaded elsewhere. The CLI help text is too terse to communicate the privacy consequence, and the skill context increases risk because prompts may contain private or sensitive content users assume remains local.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The --enable-web-search option can disclose user prompts to external web-search/back-end services, creating a privacy and data-handling risk if prompts contain secrets, personal data, or confidential project details. In this skill, prompts are free-form and may easily include sensitive information, so the absence of a clear disclosure meaningfully raises the danger.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: User prompts and stdin content are transmitted to a third-party API with no prominent warning at the point of use. In an agent/CLI context, users may accidentally paste credentials, proprietary code, or regulated data, creating a meaningful privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The embedding command uploads text from arguments, files, or stdin to a remote API without a clear user-facing warning. Because embeddings are often generated from internal documents or source code, this can cause unintended disclosure of sensitive content.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The transcription path uploads local file contents or downloaded audio to a remote API without a clear warning. Audio commonly contains sensitive conversations or personal data, so silent remote transmission increases privacy and compliance risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.