dmxapi-image-recognition

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:31 PM UTC
• Version:
  1.0.0

Overview

This skill is a coherent image-recognition helper, but users should be careful because selected images and API credentials are handled through an external DMXAPI service.

Install only if you trust the DMXAPI CLI package and are comfortable configuring an API key for it. Do not submit IDs, contracts, medical records, financial screenshots, faces, or other confidential images unless you have authorization and accept that the content may leave your device for DMXAPI or downstream model processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs users to upload local images as base64 data URLs and to submit remote image URLs to an external API, but it provides no warning that images may contain sensitive personal, financial, medical, or proprietary information. In an image-recognition skill, this omission is significant because users are encouraged to send raw visual data off-device, increasing the risk of inadvertent disclosure to a third-party service.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill includes an example for extracting a person's name and national ID number from an ID card image without any warning about handling highly sensitive personal data. This materially increases privacy and compliance risk because it normalizes sending regulated identity information to a third-party AI service without discussing consent, lawful basis, storage, or masking.

VirusTotal

65/65 vendors flagged this skill as clean.