ClawHub
Back to skill

Security audit

YOLO26 OpenVINO for AI PCs

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local computer-vision demo skill, with expected camera, model-download, and local file-output behavior that users should run intentionally.

Install this only if you want local camera or video object detection on an Intel AI PC. Before using Source 0 or monitoring-style demos, make sure camera use is intentional, visible, and allowed by applicable laws, workplace rules, and consent expectations; review optional CSV logs and output videos before sharing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation describes capabilities that require environment access, file reads/writes, and network use, but it does not declare permissions or provide an explicit trust boundary for those operations. This can cause agents or users to run setup and model-download flows without understanding that the skill will create environments, install packages, write model artifacts, and fetch remote dependencies, increasing supply-chain and local file-system risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill repeatedly promotes live camera inference and downstream people/safety monitoring, but it does not clearly warn that webcam input may capture people, surroundings, and other sensitive visual data. Without an explicit notice and consent-oriented guidance, users may enable surveillance-like functionality or process sensitive imagery without understanding privacy, policy, or retention implications.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill enables implicit invocation but does not define narrow activation constraints or gating conditions, which can cause the agent to auto-select this skill in broader contexts than intended. Because the skill can drive model export, hardware-targeted execution, and local vision workflows, unintended invocation could trigger unnecessary system actions, consume local resources, or apply the skill in contexts the user did not explicitly request.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.