Lora Finetune

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:13 PM UTC
• Version:
  1.0.0

Overview

This skill is a local LoRA fine-tuning helper with disclosed Hugging Face downloads, but its documentation overstates or mismatches some model and evaluation features.

Before installing, expect Hugging Face model downloads and use a least-privilege HF_TOKEN. Review and set --model_id explicitly because the training script defaults to FLUX.1-schnell despite documentation emphasizing Stable Diffusion, and do not rely on the advertised LLM-as-judge evaluation unless you add that functionality yourself.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill description materially overstates and misrepresents what the implementation appears to do, including model family, dataset-prep support, and evaluation functionality. This is dangerous because users may run the skill under false assumptions about data handling, model behavior, and external service usage, which can lead to unintended downloads, wasted compute, incorrect outputs, or unsafe operational decisions based on invalid evaluation claims.

VirusTotal

66/66 vendors flagged this skill as clean.