LocalDataAI

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

This skill is a local document-AI tool, but it makes strong offline, sandbox, and compliance claims that the artifacts do not actually enforce.

Review before installing, especially in regulated or confidential environments. Treat this as a local prototype rather than a verified private-computing or compliance solution: run it only in a controlled environment, manually vet downloaded models and dependencies, avoid relying on its sandbox claims, and check or disable audit/checkpoint/temp-file persistence if file paths or document metadata are sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill advertises significant capabilities including file processing, logging, model management, and downloads, yet declares no permissions. That mismatch reduces transparency and can cause the host or user to approve a skill without understanding that it may read/write local files and access the network, which is especially sensitive for a private-data processing tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documentation claims purely offline, private, local-only processing, but the described behavior includes model download helpers referencing external services and other features not aligned with that claim. For a skill handling sensitive enterprise or personal documents, this mismatch is dangerous because users may trust it with confidential data under false assumptions about network isolation and implemented safeguards.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly claims full offline operation, but the installation instructions require automatically downloading models. This creates a direct contradiction that can mislead users in regulated or air-gapped environments into deploying software that unexpectedly requires network access or pulls artifacts from external sources.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The logger computes a hash by opening whatever path is passed as `file_name`, which creates unintended read access to arbitrary local files. In a local-data processing skill, that expands the component's file access beyond audit logging and can disclose file existence or content-derived metadata for sensitive paths if untrusted input reaches `log_operation`.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code dynamically modifies sys.path to load a Python module from a sibling skill directory based on a relative filesystem path. This creates a local code-loading trust boundary violation: if that external directory or its contents are replaced, tampered with, or unexpectedly present, this skill will execute unverified code during normal operation. In a 'local private data processing' skill, that is more concerning because imported code may gain access to sensitive local documents the skill is expected to process offline.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The code presents itself as a secure, isolated sandbox that prevents data leakage, but it only creates temporary directories and then executes an arbitrary processor function in the current Python process. No OS-level filesystem isolation, network blocking, privilege reduction, or resource controls are enforced, so a processor can still read arbitrary local files, access the network, or exfiltrate data despite the security claims.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The configuration exposes security-relevant options like isolate_filesystem, restrict_network, and max_memory_mb, but none of them are applied anywhere in execution. This creates a dangerous false sense of protection: callers may enable these flags and assume isolation exists when the processor still runs without any such restrictions.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The handler writes temporary files derived from sensitive user documents to predictable paths beside the source file and only deletes them after processing. If processing crashes, deletion fails, or the directory is accessible to other local users/processes, confidential document contents may remain on disk and be exposed unexpectedly.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: Checkpoint files persist source file metadata, including file paths and hashes, to disk without an explicit user-facing control or disclosure. In a privacy-focused offline-processing skill, this creates a local data residue risk because file locations and processing history may be visible to other local users or forensic tools.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心依赖
torch>=2.0.0
transformers>=4.35.0
sentence-transformers>=2.2.2

• Confidence: 92% confidence
• Finding: Using a lower-bound-only specifier for torch allows future installs to resolve to different versions, including versions with newly introduced security regressions or breaking behavior. In a local AI file-processing skill that handles untrusted documents, dependency drift increases supply-chain risk and makes security review non-reproducible.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心依赖
torch>=2.0.0
transformers>=4.35.0
sentence-transformers>=2.2.2

# 文档解析

• Confidence: 92% confidence
• Finding: Using transformers>=4.35.0 permits uncontrolled upgrades to later releases, which can pull in vulnerable or behavior-changing versions. Because this skill processes local private data with model tooling, reproducible and reviewed dependency resolution is important to reduce supply-chain and deserialization-related exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心依赖
torch>=2.0.0
transformers>=4.35.0
sentence-transformers>=2.2.2

# 文档解析
unstructured[all-docs]>=0.11.0

• Confidence: 90% confidence
• Finding: Unpinned sentence-transformers versions make builds non-deterministic and can introduce unreviewed code changes into the environment. This is a supply-chain hygiene weakness rather than an immediate exploit by itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 文档解析
unstructured[all-docs]>=0.11.0
pymupdf>=1.23.0
pdfplumber>=0.10.0
python-docx>=0.8.11
openpyxl>=3.1.0

• Confidence: 91% confidence
• Finding: Unpinned PyMuPDF versions can resolve to unexpected releases with parser changes or security flaws. Since this skill parses PDFs and local files, parser libraries are part of the attack surface and should be tightly controlled.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 文档解析
unstructured[all-docs]>=0.11.0
pymupdf>=1.23.0
pdfplumber>=0.10.0
python-docx>=0.8.11
openpyxl>=3.1.0
pandas>=2.0.0

• Confidence: 91% confidence
• Finding: Using pdfplumber with only a minimum version allows unreviewed upgrades and reduces build reproducibility. Document-parsing libraries routinely process attacker-controlled input, so version drift can materially affect exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

unstructured[all-docs]>=0.11.0
pymupdf>=1.23.0
pdfplumber>=0.10.0
python-docx>=0.8.11
openpyxl>=3.1.0
pandas>=2.0.0

• Confidence: 91% confidence
• Finding: Unpinned python-docx versions increase supply-chain uncertainty and may introduce parser-related vulnerabilities without review. Because this skill handles office documents, the context makes parser dependency control more important than in a non-file-processing project.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymupdf>=1.23.0
pdfplumber>=0.10.0
python-docx>=0.8.11
openpyxl>=3.1.0
pandas>=2.0.0

# OCR

• Confidence: 91% confidence
• Finding: openpyxl is used to parse spreadsheet content, and lower-bound-only versioning permits unreviewed future releases. In a workflow that may ingest untrusted Excel files, dependency drift enlarges the attack surface.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pdfplumber>=0.10.0
python-docx>=0.8.11
openpyxl>=3.1.0
pandas>=2.0.0

# OCR
paddlepaddle-gpu>=2.5.0; sys_platform != "darwin"

• Confidence: 88% confidence
• Finding: Using pandas>=2.0.0 is a supply-chain hygiene issue because it makes installations non-reproducible and can silently adopt risky versions. By itself this is not direct code execution, but it weakens dependency control.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# OCR
paddlepaddle-gpu>=2.5.0; sys_platform != "darwin"
paddlepaddle>=2.5.0; sys_platform == "darwin"
paddleocr>=2.7.0
easyocr>=1.7.0

# 向量数据库

• Confidence: 89% confidence
• Finding: Unpinned paddleocr versions can introduce unreviewed OCR parser/model-processing changes. OCR and document ingestion paths commonly handle adversarial files, so deterministic builds are important for risk reduction.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

paddlepaddle-gpu>=2.5.0; sys_platform != "darwin"
paddlepaddle>=2.5.0; sys_platform == "darwin"
paddleocr>=2.7.0
easyocr>=1.7.0

# 向量数据库
chromadb>=0.4.0

• Confidence: 88% confidence
• Finding: easyocr>=1.7.0 allows non-deterministic upgrades in a library that processes user-supplied image data. That increases supply-chain and parser risk in this local document-processing context.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

easyocr>=1.7.0

# 向量数据库
chromadb>=0.4.0
faiss-cpu>=1.7.4

# 文本处理

• Confidence: 87% confidence
• Finding: Unpinned chromadb versions weaken reproducibility and can introduce unexpected security or persistence behavior. While not inherently exploitable from this file alone, it is still a dependency-management weakness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 向量数据库
chromadb>=0.4.0
faiss-cpu>=1.7.4

# 文本处理
langchain>=0.1.0

• Confidence: 87% confidence
• Finding: faiss-cpu with only a minimum version allows unreviewed upgrades and undermines reproducibility. This is mainly a supply-chain risk rather than a direct vulnerability visible from the manifest alone.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

faiss-cpu>=1.7.4

# 文本处理
langchain>=0.1.0
langchain-community>=0.0.10
jinja2>=3.1.0
pyyaml>=6.0.1

• Confidence: 93% confidence
• Finding: langchain has a large and fast-moving attack surface, and lower-bound-only versioning can silently pull in unsafe releases. In an AI processing skill, framework drift can expose deserialization, prompt-loading, connector, or tool-execution risks.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 文本处理
langchain>=0.1.0
langchain-community>=0.0.10
jinja2>=3.1.0
pyyaml>=6.0.1

• Confidence: 93% confidence
• Finding: langchain-community includes many integrations and loaders, so unpinned resolution materially increases exposure to newly introduced vulnerabilities. This is more dangerous in a skill that ingests files and may later interface with external components.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 文本处理
langchain>=0.1.0
langchain-community>=0.0.10
jinja2>=3.1.0
pyyaml>=6.0.1

# 编码检测

• Confidence: 90% confidence
• Finding: Jinja2 is often security-sensitive when templates can be influenced by data or users, and lower-bound-only versioning permits unreviewed releases. In systems that may render templates for prompts, reports, or outputs, version control matters.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain>=0.1.0
langchain-community>=0.0.10
jinja2>=3.1.0
pyyaml>=6.0.1

# 编码检测
chardet>=5.2.0

• Confidence: 91% confidence
• Finding: PyYAML has a history of unsafe deserialization issues, so leaving it unpinned increases the chance of silently deploying an unsafe or regressed version. This is especially relevant if configuration or metadata files are parsed from local content.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.