Pywayne Cv Apriltag Detector

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:35 AM UTC
• Version:
  0.1.0

Overview

This skill is a straightforward AprilTag image-detection guide, with a disclosed runtime dependency install that users should be aware of.

Install this only if you are comfortable with the detector automatically fetching apriltag_detection through gettool when the dependency is missing. For lower risk, use it in a virtual environment and confirm that gettool and the dependency source are trusted or pinned before running detection.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly states that it will automatically install the `apriltag_detection` library using `gettool` if the dependency is missing, but it does not warn the user that invoking the detector may trigger network access and modify the local environment. In an agent setting, silent dependency installation expands the trust boundary and can lead to unexpected package downloads, supply-chain risk, or unauthorized changes on the host system.

VirusTotal

64/64 vendors flagged this skill as clean.