ClawHub
Back to skill

Security audit

Dataset Splitter

Security checks across malware telemetry and agentic risk

Overview

This is a local dataset-splitting utility whose file-moving behavior is expected for its purpose, but users should run it carefully because the default split moves files unless copying is requested.

Install in a virtual environment if you need Pillow. Before running a split, back up the dataset or pass --copy if you want the source folder preserved. Use --yolo when you expect label files to be split with images, and verify the output before deleting originals or updating training pipelines.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill describes dataset splitting operations but does not clearly warn users that files may be moved or reorganized into new directory structures unless a copy mode is used. This can lead to unintended modification of the original dataset, broken downstream pipelines, or accidental data loss if a user assumes the operation is non-destructive.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script moves files by default unless --copy is explicitly set, which means running it can destructively alter or partially dismantle the source dataset. In an agent or automation context, this increases the chance of accidental data loss, broken training pipelines, and inconsistent datasets if execution is interrupted mid-operation or if the user assumes the operation is non-destructive.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.