Security audit

Image Audit

Security checks across malware telemetry and agentic risk

Overview

This image-audit skill does what it says at a high level, but it also uses broad credential lookup, sends a machine identifier to the API, and can modify the system by installing a global package at runtime.

Review this before installing if you handle private images, internal URLs, or sensitive project directories. Use a dedicated NX_API_KEY, avoid running it from a directory tree containing unrelated .env secrets, avoid saving keys into project .env files that may be committed, and be aware it can upload images or URLs to ai.nxtici.com, send a stable device identifier, and install sharp globally if missing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill performs environment access and outbound network actions, but these capabilities are not explicitly declared in a permission model. That reduces transparency and makes it easier for a user or runner to underestimate what the skill can read and transmit, especially since it uploads local images and may consume credentials from local configuration.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is image moderation, but the behavior extends to scanning for .env files up the directory tree and in the home directory, installing global packages, accepting remote URLs, and generating a device fingerprint from host and MAC data. Those extra behaviors materially expand data access and system impact beyond what a user would reasonably expect from a simple image-audit skill.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Searching upward through parent directories and then falling back to ~/.env to locate NX_API_KEY gives the skill access to credentials outside the immediate task scope. This broad secret discovery pattern can unintentionally expose unrelated project or personal tokens and is excessive for an image-review workflow.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Persisting a user-provided API key into the current working directory's .env file creates a long-lived local secret without a clear need or explicit persistence warning. That can leak credentials into source trees, backups, shared workspaces, or version control, turning a transient action into a broader credential exposure risk.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill claims pure in-memory execution and says not to write temporary files, yet it instructs writing NX_API_KEY into a project .env file. This inconsistency is dangerous because it misleads users about side effects and can cause them to overlook that sensitive credentials will be persisted locally.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill manifest describes local image auditing after compression, but the script also accepts arbitrary remote URLs via --urls and submits them directly to the external API. This creates a capability gap between stated behavior and actual behavior, which can expose third-party or internal-only image URLs and bypass the local compression/data-minimization path users would expect.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script derives a stable device identifier from hostname and MAC addresses, then transmits it to the remote API. That fingerprint is unrelated to the core image-audit function and enables persistent tracking of the user's machine across runs, leaking host-level metadata to an external service.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script recursively loads .env files from the current directory up to filesystem root and also from ~/.env, which is broader than necessary for this task. This behavior can unintentionally ingest unrelated secrets from parent projects or the user's home environment, increasing the blast radius of secret exposure if later logged, misused, or transmitted.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: If sharp is missing, the script executes shell commands to discover global module paths and automatically runs npm install -g sharp at runtime. Runtime package installation is dangerous because it performs networked code retrieval and execution outside normal dependency management, expanding supply-chain and execution risk far beyond simple image auditing.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly states that user images are sent directly to an external NX API for moderation, but it does not clearly warn users about third-party data transfer, retention, or privacy implications. Because images may contain sensitive personal content, failing to disclose external transmission can lead to unintentional exposure of private data and non-compliant handling of user information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill tells operators to save a provided API key into a local .env file but does not clearly warn that the credential will persist on disk. Without that warning, users may unknowingly leave secrets in repositories or shared directories where they can be recovered later.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill description emphasizes moderation functionality but does not clearly warn that local images and supplied URLs are uploaded to an external API. Because images may contain sensitive or regulated content, missing a prominent privacy disclosure undermines informed consent and increases the chance of unintended data exfiltration to a third party.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script sends compressed local images or supplied URLs, along with a device identifier, to a remote API without a clear upfront disclosure or consent prompt. For sensitive images or private URLs, this can cause unintended external data sharing and privacy violations, especially since users may assume processing is local apart from obvious API-key usage.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/audit.js:91

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/audit.js:39