Nsfw Detector Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:51 PM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for NSFW moderation, but it asks users to install an unreviewed npm package and enables retention of sensitive moderation results without enough privacy guidance.

Review this before installing. Use an isolated environment, pin and inspect the npm package and its dependency tree, and avoid processing intimate or legally sensitive content until you have clear consent, retention, logging, deletion, and access-control policies. Disable or minimize caching unless you have a specific compliant reason to retain moderation results.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned and Unreviewable Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-25; related dependency declarations at lines 104-109
Vulnerability Type: Supply-chain exposure through an unpinned external npm package
Risk Level: Medium

Vulnerable Code

markdown

## Installation

### Via ClawHub

https://clawhub.ai/raghulpasupathi/nsfw-detector-pro

text

### Via npm
```bash
npm install @raghulpasupathi/nsfw-detector-pro

text

The document also claims the following dependencies without providing a package manifest or lockfile:

```markdown
## Dependencies
- **@tensorflow/tfjs-node-gpu**: ^4.0.0 - TensorFlow for GPU inference
- **sharp**: ^0.32.0 - Image processing
- **opencv4nodejs**: ^6.0.0 - Computer vision operations
- **ffmpeg-fluent**: ^2.1.0 - Video processing
- **nsfw.js**: ^3.0.0 - Pre-trained NSFW model

Technical Analysis

The installation command does not specify an exact package version or integrity hash. Consequently, npm resolves whichever package version is selected by the registry at installation time. The reviewed project contains only SKILL.md; it does not include the package's implementation, a package.json, a lockfile, checksums, or vendored source code.

This prevents the advertised implementation, npm lifecycle scripts, transitive dependency graph, network behavior, model provenance, and handling of analyzed content from being verified as part of this audit. The package installed by a user may also differ from the package that existed when the skill documentation was reviewed.

The dependency versions shown in the documentation use semver ranges, but no lockfile is supplied to make their resolution reproducible. Documentation alone does not prove that these are the package's complete or actual dependencies.

Attack Path

1. A user follows SKILL.md and runs npm install @raghulpasupathi/nsfw-detector-pro.
2. npm contacts the configured registry and resolves ...[truncated 1735 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the primary package to a reviewed exact version, for example:

   bash

   npm install --save-exact @raghulpasupathi/nsfw-detector-pro@1.0.0
   

   The named version must be independently reviewed before use; pinning alone does not establish trust.

2. Add a complete package.json and committed npm lockfile so that direct and transitive dependency resolution is reproducible and integrity values are recorded.

3. Include the detector's source code in the review scope, or link to an immutable source revision and provide a verifiable mapping between that revision and the published npm artifact.

4. Inspect the package archive before installation:

   • Review lifecycle scripts and executable files.
   • Verify package ownership, provenance, signatures, and publication history.
   • Compare the archive against the reviewed source.
   • Audit the complete transitive dependency graph.

5. During initial inspection, install in an isolated environment with lifecycle scripts disabled:

   bash

   npm install --ignore-scripts --package-lock-only
   

   Enable required scripts only after they have been reviewed.

6. Run the detector with least privilege in a sandbox or container. Do not expose unnecessary host files, credentials, privileged sockets, or unrestricted outbound network access.

7. Pin model artifacts and other runtime downloads by cryptographic digest. Do not retrieve executable code or mutable model files from unverified locations at runtime.

8. Add automated dependency scanning, lockfile verification, provenance checks, and controlled update review to CI/CD.

9. Add the missing implementation and referenced example file to the project so the documented behavior can be tested and audited.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly processes highly sensitive user-provided images, videos, and text, including sexual content and potential underage-content detection, but the description provides no privacy notice, handling limitations, or disclosure about how such content is processed. This can lead deployers to ingest regulated or intimate content without informed consent, appropriate policy controls, or understanding of privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The configuration enables caching of moderation results for up to 86400 seconds without any warning about retention of sensitive inference outputs tied to explicit images, videos, or text. Even if raw media is not cached, stored classifications, confidence scores, and identifiers can expose intimate behavioral data, create compliance issues, and increase the blast radius of a breach.

Content

No source excerpt is available for this finding.