ClawHub
Back to skill

Security audit

Perceptron

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Perceptron vision-analysis skill, but it sends user-selected images or URLs to an external API and should be used only with data appropriate for that service.

Install this only if you are comfortable using Perceptron's external service for the images, videos, prompts, OCR outputs, and URLs you provide. Prefer a virtual environment, pin and review the `perceptron` package version, keep the API key scoped and private, and do not process regulated, confidential, or internal-only content without approval.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash
pip install perceptron

The installed package is subsequently imported and trusted by scripts/perceptron_cli.py:20-47:

python
try:
    import perceptron
    from perceptron import (
        configure,
        config,
        detect,
        caption,
        ocr,
        ocr_html,
        ocr_markdown,
        question,
        perceive,

        annotate_image,
        scale_points_to_pixels,
        extract_points,
        parse_text,
        strip_tags,
        inspect_task,
        image,
        text,
        system,
        box,
        point,
        polygon,
        collection,
        agent,
    )
except ImportError:
    print("Error: perceptron SDK not installed. Run: pip install perceptron", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The documented installation command retrieves the latest package associated with the mutable perceptron package name. It does not specify an exact reviewed version, verify distribution hashes, use a lockfile, or document verification of the package source and publisher.

The imported dependency is security-sensitive: it receives the Perceptron API credential, processes local image files and URLs, handles prompts, and performs remote API requests. If a future package release or its publishing account were compromised, arbitrary package code could execute with the permissions of the user running the installation or CLI.

This is a supply-chain weakness rather than evidence that the current package is malicious.

Attack Path

  1. An attacker compromises the package publisher, release pipeline, or package repository account for perceptron.
  2. The attacker publishes a malicious release under the same package name.
  3. A user follows the documented pip install perceptron instruction after that release becomes current. ...[truncated 950 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed version, for example:

    bash
    python3 -m pip install "perceptron==X.Y.Z"

  2. Generate and publish a lockfile containing cryptographic hashes for the approved distributions.

  3. Require hash verification during installation, such as:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  4. Document the expected package repository, verified publisher, and approved package identity.

  5. Review release notes and dependency changes before updating the pinned version.

  6. Run the CLI in a least-privileged virtual environment or container with access only to required images and credentials.

  7. Avoid exposing unrelated secrets or sensitive directories to the process.

  8. Add automated dependency scanning and provenance verification to the release workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tainted flow: 'api_key' from os.environ.get (line 379, credential/environment) → httpx.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/perceptron_cli.py (reported line 380)May include surrounding context.

python
s = settings()
        base = (s.base_url or "https://api.perceptron.inc").rstrip("/")
        api_key = s.api_key or os.environ.get("PERCEPTRON_API_KEY", "")
        resp = httpx.get(f"{base}/v1/models", headers={"Authorization": f"Bearer {api_key}"}, timeout=15)
        resp.raise_for_status()
        for m in resp.json().get("data", []):
            owned = m.get("owned_by", "")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill exposes capabilities that can access environment variables, read local files and issue network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it easier for an agent or operator to invoke the skill without understanding that local files, URLs, and secrets-backed outbound requests may be involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill encourages passing file paths or URLs directly to the SDK and states that the SDK handles conversion automatically, but it does not clearly warn that the referenced images, videos, or fetched URL content are transmitted to an external Perceptron service. This can lead users or downstream agents to send sensitive local media, documents, or internal URLs off-box without informed consent, creating confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 39)May include surrounding context.

List models programmatically:

python
import httpx
resp = httpx.get("https://api.perceptron.inc/v1/models",
                 headers={"Authorization": "Bearer YOUR_API_KEY"})
for m in resp.json()["data"]:
    print(m["id"])

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The example shows sending a local image file to a remote vision API, which means image contents may leave the user's environment. In an image/video analysis skill, that behavior is expected, but the documentation snippet does not clearly warn users about potential disclosure of sensitive visual data such as PII, documents, or internal screenshots.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly advertises a reasoning=True mode and shows printing result.reasoning, which appears to expose internal chain-of-thought to callers. Releasing reasoning traces can disclose sensitive intermediate analysis, prompt content, policy-relevant internals, or unsafe guidance that should remain hidden, and it exceeds ordinary image-analysis output expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The reasoning-traces section demonstrates exposing raw reasoning output without any warning, gating, or limitation, encouraging downstream developers to log or display sensitive model internals directly. In a vision-analysis skill, such traces may include sensitive inferences about images, latent prompt content, or unsafe intermediate steps, increasing information disclosure and misuse risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly suggests using a <hint>THINK</hint> mode to obtain reasoning traces or chain-of-thought. Exposing internal reasoning can lead to policy violations, leakage of sensitive intermediate analysis, and make it easier for downstream users to elicit hidden reasoning that should instead be summarized safely. In this skill context, the risk is somewhat elevated because the feature is presented as a best practice in prompt guidance, which may encourage broad adoption by integrators.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The CLI help for detect says users can choose box, point, or polygon output geometry, implying the command will honor that intent. However, cmd_detect never passes args.expects into detect(), so the documented behavior contradicts the actual implementation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code invokes remote SDK operations for detection, and the file-level/help text does not clearly warn users that local image paths/URLs and prompt content may be sent to an external API. The same pattern appears throughout the CLI, so users may not realize potentially sensitive image data is leaving their system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The command persists OCR/caption/perception results to disk as JSON, which can include extracted text and annotations from user images. Although the write is user-directed via --output, the code provides no prior disclosure in comments, help text, or command description about saving potentially sensitive content locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest describes an analysis skill for vision tasks such as OCR, detection, captioning, and spatial reasoning. In addition to those functions, the code adds operational capabilities to list remote models via a direct HTTP request and display SDK configuration including base URL and masked API-key presence, which are not part of the stated end-user analysis scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code reads the PERCEPTRON_API_KEY environment variable and transmits it in an Authorization header to a remote endpoint. While expected for API access, there is no explicit disclosure in the command help or nearby comments that the command performs a network call using stored credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.