Security audit

DiT360 Panorama Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says, but users should know it sends prompts to Hugging Face, installs a Python dependency at runtime, and starts a local viewer server.

Install only if you are comfortable sending panorama prompts to Hugging Face and loading viewer assets from jsdelivr. Avoid secrets, personal data, or proprietary prompt text. Review the dependency install line before running, and stop the local server after viewing if you do not want port 8899 left open.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes capabilities that read/write local files and execute shell scripts, but it does not declare any permissions or capability requirements. This creates a transparency and consent problem: users or host platforms may invoke the skill without understanding that it will create files, start a server, and run local commands. In this context the behavior appears aligned with the skill's stated purpose, so the issue is under-declaration rather than overtly malicious behavior.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script installs a Python package from external package indexes at runtime using `uv pip install ... || pip3 install ...`. Runtime dependency installation introduces supply-chain risk, allows unpinned package resolution to change over time, and executes package installation behavior on the user's system without prior verification. In this skill context, package installation is related to the stated functionality, but doing it dynamically and implicitly still makes the behavior meaningfully dangerous.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill performs an additional action beyond the stated panorama generation purpose by automatically launching an HTTP server to publish output files. This increases attack surface and may expose generated content or nearby files in the output directory to any local user or, depending on network configuration, other reachable hosts without clear disclosure or consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill sends user-provided prompts to a remote Hugging Face Space, but the user-facing description does not clearly warn that prompt contents leave the local environment. This is a privacy and data-handling risk because users may enter sensitive or proprietary text assuming the generation is local, especially since the skill also emphasizes local viewing and file creation.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code sends the user's prompt to a third-party Hugging Face Space, but the behavior is not clearly disclosed as off-host data transfer before transmission occurs. If users include sensitive, proprietary, or personal content in prompts, this can cause unintended data disclosure to an external service and its operators/logging systems.

Static analysis

No suspicious patterns detected.