Security audit

Python Sdk

Security checks across malware telemetry and agentic risk

Overview

This is coherent Python SDK documentation, but it deserves review because it grants broad local Python execution and includes examples that can transmit files, use webhooks/secrets, persist chats, and copy unsafe tool-handling patterns.

Install only if you want an inference.sh Python SDK reference that can run local Python commands when invoked. Do not upload files, prompts, API keys, or webhook payloads unless you intend to send them to inference.sh or another configured service. Avoid public uploads for sensitive content, protect webhook/API secrets, and do not copy the eval() or unvalidated tool-execution examples into production code.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The example handler executes user-controlled input with Python eval(), which can run arbitrary code rather than just perform math. In this SDK context, tool arguments may be model-generated or indirectly user-influenced, so copying this example could lead to remote code execution in the host application.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: This generic tool-handling example includes a calculate branch that uses eval() on call.args['expression'], normalizing an unsafe pattern in sample code. Because developers often paste documentation examples directly, this can introduce arbitrary code execution into any app exposing that tool path.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger list includes broad terms such as 'python api', 'python integration', and 'programmatic ai' that are not uniquely tied to this specific skill. Overbroad triggers can cause the skill to activate in unrelated contexts, increasing the chance that users are steered into using this SDK or its network/file-handling capabilities when another skill would be more appropriate.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file handling section states that local paths are 'Auto-uploaded' but does not prominently warn that supplying a filesystem path will transmit local file contents to a remote service. In an agent context, this can lead to unintended exfiltration of sensitive local data if a user or downstream component passes a path without understanding the network side effect.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The webhook tool example posts to an external Slack webhook endpoint without an explicit warning that tool inputs may be sent to a third-party service. In agent workflows, this creates a real risk of unintended outbound transmission of prompts, secrets, or sensitive operational data via a webhook configured from example code.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The conversation memory example writes full chat history to a local JSON file and reloads it later without any warning, minimization, encryption, or access controls. In an SDK reference for agent development, this can lead developers to persist sensitive prompts, model outputs, credentials, personal data, or proprietary business information in plaintext, where it may be exposed to other users, backups, logs, or source control.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The examples repeatedly send prompts and arbitrary input data to an external inference service, including in web framework handlers that directly forward user-supplied values. While this is expected SDK behavior, the documentation does not warn developers that prompts, uploaded content, or processed data leave the local environment, which can lead to inadvertent disclosure of sensitive data in production integrations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The examples encourage uploading local files, bytes, base64 data, and remote URLs to an external service without clearly warning that sensitive local content will be transmitted off-host and that uploads may be publicly accessible when options like public=True are used. In an SDK used for automation and agents, users may copy these snippets into production workflows and unintentionally exfiltrate private data or expose files via direct URLs.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The download examples fetch remote content and write it directly to local paths such as output.png without warning that this creates or overwrites files on disk. In SDK and agent contexts, users may adapt these patterns for automated pipelines, increasing the chance of accidental overwrites, unsafe file placement, or storing untrusted content locally without validation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.