ClawHub
Back to skill

Security audit

MLX Swift LM Expert

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Swift ML skill whose examples fit local LLM/VLM development, with ordinary cautions around model downloads and saved caches.

Reasonable to install for Swift MLX reference material. When copying examples, pin or trust model sources, protect Hugging Face tokens, validate remote media URLs, require confirmation for side-effecting tool calls, and treat saved prompt caches or training artifacts as potentially sensitive local files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The documentation shows how to save prompt caches and arbitrary metadata to disk, including an example metadata field containing prompt text, but it does not warn that cache contents and metadata may persist sensitive user inputs locally. In an LLM skill focused on prompt reuse and local inference, this omission can lead developers to unintentionally store confidential prompts, conversation data, or derived model state without considering retention, access controls, or cleanup.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.