ClawHub
Back to skill

Security audit

Image Annotation QC

Security checks across malware telemetry and agentic risk

Overview

This is a local image-annotation quality checker that reads chosen dataset folders and writes local reports, with no evidence of hidden networking, credential use, or destructive behavior.

Install this if you want local QC for image annotations. Run it only on intended dataset folders, use `--output` to keep generated reports separate from source annotations, and install the Python dependencies in a trusted environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill metadata declares no permissions, but the documented behavior clearly includes reading images/annotations and writing reports and visualization files. This mismatch can mislead users or enforcement systems about the skill's actual filesystem access, increasing the chance of unintended data exposure or writes in sensitive directories.

Missing User Warnings

Low
Confidence
76% confidence
Finding
The skill advertises automatic report and visualization generation, but does not prominently warn that running it will create files on disk. Users may invoke it expecting read-only analysis and unintentionally modify working directories or consume storage, especially when processing large datasets.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The output documentation says files are generated in or under the annotation directory by default, but it lacks a caution that this modifies user data locations. In environments where annotation directories are versioned, shared, or tightly controlled, these implicit writes can create operational or integrity issues.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.