ClawHub
Back to skill

Security audit

MLX Local AI

Security checks across malware telemetry and agentic risk

Overview

This local AI skill mostly matches its purpose, but it needs review because it can run downloaded model code in a background service without clearly warning the user.

Install only if you are comfortable running shell scripts, unpinned Python packages, and downloaded model code on your Mac. Review start_ai.sh before use, consider removing --trust-remote-code, verify the model source and mirror, and confirm what ~/embedding_server.py is before starting the services.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The skill instructs users to copy an environment file and permanently source it from ~/.zshrc without warning about persistent shell configuration changes. This can silently alter future shell sessions, affect unrelated workflows, and create a durable execution path for any unsafe content later placed in that file.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script performs multiple network actions automatically: it installs Python packages from package indexes and downloads models from a configured mirror endpoint. Because there is no explicit consent prompt or clear warning before these fetches, users may unknowingly execute code and retrieve artifacts from external sources, increasing supply-chain and privacy risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The uninstall branch deletes files under the user's home directory immediately, without confirmation or a dry-run preview. Although the paths are fixed and quoted, the operation is still destructive and can remove user data or custom modifications unexpectedly if invoked by mistake.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
Using --trust-remote-code allows model-provided Python code from the model repository to execute locally during startup. Because the script also redirects downloads to a mirror endpoint, this increases supply-chain risk: a compromised or malicious model repo or mirror could execute arbitrary code with the privileges of the user running the script.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.