Vlmrun Cli Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:42 PM UTC
• Version: 0.1.1

Overview

This skill is a straightforward guide for using the VLM Run CLI, but users should understand that files may be uploaded to a remote service and cached locally.

Install in an isolated virtual environment, consider pinning or reviewing the vlmrun package version before use, and avoid sending confidential images, videos, PDFs, contracts, invoices, or other sensitive files unless you accept VLM Run's handling of uploaded data. Clear or relocate the cache when working with private generated artifacts, and start fresh sessions for sensitive tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Remediation

View remediation

" ``` 2. Generate and commit a lock file that fixes all transitive dependency versions. 3. Require cryptographic hashes for resolved packages where supported, and fail installation on a hash mismatch. 4. Configure installation to use an explicitly trusted package index and disable unintended fallback indexes to reduce dependency-confusion exposure. 5. Review package provenance, release signatures, maintainers, and dependency changes before updating the pinned version. 6. Run installation and the CLI as an unprivileged user in an isolated virtual environment or container. 7. Warn users not to expose sensitive API keys or files until the installed package version and source have been verified. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages processing images, videos, and documents with a remote AI service but does not clearly warn users that their inputs are uploaded off-device. This creates a real privacy and data-handling risk because users may submit sensitive media or documents under the assumption processing is local or otherwise not externally transmitted.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill explicitly promotes continuing prior sessions, which means past prompts, artifacts, and context may influence later interactions. In a visual AI workflow, this can unintentionally retain sensitive data across tasks, causing privacy leakage or cross-task data exposure if users reuse session IDs without understanding the persistence model.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

bash

# Start a new session of an image generation task where a new character is generated
vlmrun chat "Create an iconic scene of a ninja in a forest, practicing his skills with a katana?" -i photo.jpg

# Use the previous chat session in context to retain the same character and scene context (where the session ID is <session_id>)
vlmrun chat "Create a new scene with the same character meditating under a tree" -i photo.jpg -s <session_id>

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation notes default cache locations and continued sessions, but it does not clearly warn that generated artifacts and session-related data can persist locally and be reused across sessions. This can expose prior inputs or outputs to other local users, future runs, or accidental disclosure if users assume outputs are ephemeral.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.