Security audit
Security checks for vulnerabilities and agentic risk
This is a Gradio reference skill with examples, and the sensitive behaviors are visible, purpose-related, and not automatic.
Use this skill as a Gradio reference, but review examples before copying them into real apps. Remote `gradio predict` calls can upload selected files to the target Space, webcam and microphone components can capture sensitive media, and toy health or finance examples should not be reused for real advice without proper consent, privacy controls, and domain safeguards.
The skill explicitly demonstrates gradio predict against external Spaces and includes a file-upload example that sends a local path marked as gradio.FileData to a remote server. In an agent skill context, this can normalize or induce exfiltration of local files to third-party services without a clear warning, consent gate, or guidance on restricting uploads to non-sensitive data.
The example presents a medical-style intake flow that collects symptoms and returns a diagnosis-like output ('covid' or 'flu') without any disclaimer, privacy notice, or statement that it is not medical advice. In a reusable example library, this can normalize unsafe handling of health data and encourage downstream developers to deploy symptom triage interfaces without appropriate consent, data minimization, or regulatory safeguards.
The webcam streaming demo enables live camera capture from the browser and continuously streams frames without any user-facing warning about what is being captured, processed, or retained. Although browser permissions gate access, example code like this can be copied into applications that handle sensitive visual data, leading to privacy surprises or over-collection without clear notice.
No suspicious patterns detected.
