Security audit

Multimodal Base

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed multimodal helper that sends user-selected images/audio to configured AI services and writes temporary/output audio files as part of its stated purpose.

Install only if you are comfortable sending selected images/audio to OpenAI-compatible services when API mode is used. Use local speech/OCR modes for sensitive content where possible, keep API keys scoped, and avoid using shared output directories for confidential speech or SSML text.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation advertises image understanding and speech recognition via GPT-4V/OpenAI APIs but does not clearly warn that user-provided images and audio may be transmitted to external third-party services in API mode. This creates a real privacy and compliance risk because users may unknowingly send sensitive biometric, personal, or confidential content off-device.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code sends the full image contents to an external API by embedding the base64-encoded image in a request to the configured OpenAI-compatible endpoint, but there is no consent gate, warning, or policy check before upload. This can expose sensitive screenshots, documents, IDs, or other private visual data to third-party services unexpectedly, especially when callers assume processing is local.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This code sends the full audio file to a third-party API by default in API mode, but provides no explicit disclosure, consent mechanism, or policy gate. In a multimodal agent context, audio may contain sensitive personal, financial, or confidential business data, so silent external transmission creates a real privacy and compliance risk.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The streaming path buffers audio and writes it to a temporary file on disk without any explicit disclosure or controls around storage duration, location, or permissions. While the file is later deleted, temporary persistence of potentially sensitive audio increases exposure to local compromise, forensic recovery, or accidental retention.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The module writes raw SSML content to a predictable temporary file under the output directory, which may expose sensitive user-provided content to other local users or processes and can leave data behind if execution fails before cleanup. Because the file is created in a shared application-controlled directory rather than a securely permissioned temporary location, this creates avoidable data-at-rest exposure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/speech-recognizer.js:75

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/speech-synthesizer.js:156

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/image-processor.js:22

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/speech-recognizer.js:31

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/image-processor.js:22

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/speech-recognizer.js:31