Security audit

Pill Counter Skill

Security checks across malware telemetry and agentic risk

Overview

This is a pill-counting tool with a local default mode and an optional AI mode that uploads the chosen image only when the user selects it.

Use the default OpenCV mode for sensitive images because it stays local. Only use --ai when you are comfortable sending the selected pill photo to Xiaomi MiMo and using the configured API key, which may reveal medical details and consume paid quota.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The AI mode transmits the user-provided image to an external MiMo API, but the warning is minimal and does not clearly state that image contents may contain sensitive personal or medical information. In a pill-counting context, uploaded photos can reveal health conditions, prescription details, or other private data, so insufficient disclosure can lead to unintended privacy exposure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: In AI mode, the tool base64-encodes the user-supplied image and sends it to a third-party API, but the runtime flow does not present a clear user-facing warning or consent step about external data transmission. Because images may contain sensitive medical information, pill regimens, packaging labels, or contextual personal data, silent transmission creates a real privacy and compliance risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.