Security audit

Javascript Sdk

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real JavaScript SDK documentation skill, but it needs Review because it combines broad Node/npm command authority with unsafe copy-paste examples around credentials, uploads, public files, tool execution, and eval.

Install only if you are intentionally working with @inferencesh/sdk. Approve npm, npx, node, yarn, and pnpm commands case by case; keep real API keys server-side; do not use NEXT_PUBLIC variables for privileged keys; upload only files you intend to send to the service; avoid public: true for sensitive files; replace eval examples with a safe parser; and add allowlists, validation, and human approval around webhooks, browser automation, code execution, and model-triggered tools.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document explicitly states API keys should never be exposed in browser code, but the local testing example then encourages use of `process.env.NEXT_PUBLIC_INFERENCE_API_KEY` on the client side. In Next.js, `NEXT_PUBLIC_` variables are embedded into frontend bundles, so developers following this example may unintentionally expose live or reusable credentials and normalize insecure key handling.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill description includes very broad trigger phrases such as 'npm install', 'node.js api', 'frontend sdk', and 'js integration', which are generic terms likely to match many unrelated developer requests. This can cause the skill to activate outside its intended scope, injecting irrelevant or powerful guidance into unrelated workflows and increasing the attack surface for prompt/skill hijacking.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation explicitly encourages automatic upload of local file paths and manual upload of local files to a remote service, but does not warn that passing a path causes the SDK to transmit file contents off-host. In a file-handling reference, readers are especially likely to copy these patterns directly, so omission of a privacy/data-exfiltration warning can lead to accidental upload of sensitive local files such as credentials, internal documents, or PII.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The example shows `public: true` for uploaded files and labels them as publicly accessible without warning about access exposure, retention, or link sharing risk. Users may copy this option into production and unintentionally expose sensitive documents or media to anyone with the resulting URL or to broader public access, depending on backend semantics.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The FileUpload example immediately uploads a user-selected file to a remote service via client.uploadFile(file) but the UI only shows a local preview and an 'Uploading...' indicator. Without an explicit user-facing disclosure or confirmation that the file will be transmitted off-device, developers may copy this pattern into production and cause unintended sharing of sensitive data such as images or documents.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The example instructs developers to switch to a public frontend API key in development without prominently warning that the credential becomes accessible to any browser user. Because this is SDK documentation, readers are likely to copy-paste the snippet, which increases the chance of accidental credential exposure, abuse of the API account, and confusion about safe deployment practices.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The browser automation examples demonstrate clicking buttons, typing credentials, and navigating pages without any warning that these actions can submit forms, change account state, or affect third-party services. In an SDK reference, this omission can normalize unsafe automation patterns and lead developers to expose powerful actions to end users without confirmation, scope limits, or audit controls.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The agent streaming example automatically executes tool calls from model-generated instructions and immediately submits results, with no validation, allowlist enforcement, or human approval. In agent contexts, this can cause unintended external actions, data access, or command execution if the model is manipulated or makes a bad tool selection.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/server-proxy.md:137