VTL Image Analysis

• Outcome: Pass
• Latest audit: May 28, 2026, 9:01 AM
• Version:
  1.0.0

Overview

This skill locally analyzes image composition and generates prompt variants, with no evidence of hidden network access, persistence, credential use, or destructive behavior.

Reasonable to install for local analysis of images you choose to provide. Use the bundled or otherwise trusted operators.yaml, avoid passing untrusted operator files, and consider an isolated Python environment because dependencies are installed from pip.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The skill says to invoke proactively after image generation and when a user has requested better compositional quality, which can cause the agent to run analysis and generate follow-up prompts without a specific, current user request. That broad trigger can lead to unexpected processing of user images or prompts, extra file access, and behavior that exceeds user intent, especially in multi-step agent workflows.

VirusTotal

66/66 vendors flagged this skill as clean.