ClawHub
Back to skill

Security audit

Basic Object Detection Skill | 基础目标检测技能

Security checks across malware telemetry and agentic risk

Overview

The skill performs object detection, but it also silently creates or reuses a cloud identity, uploads media or URLs, queries cloud history, and stores local tokens, so it needs careful review before installation.

Install only if you are comfortable with surveillance images, videos, media URLs, report queries, and identity-linked metadata being sent to LifeEmergence cloud services. Avoid private camera-feed URLs or sensitive local media unless you have approval, and review how the service handles account creation, token storage, history retention, and deletion.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
74% confidence
Finding
This code applies filters using getattr(self.__model__, key) where key comes from the caller-provided filters dict. An attacker who can influence filter keys may trigger access to unintended model attributes, cause exceptions for nonexistent attributes, or abuse ORM descriptors to alter query behavior, resulting in denial of service or unauthorized querying paths.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
Like the list() method, this count() path resolves model attributes from caller-controlled filter keys without validation. That can allow query manipulation via unintended attributes or repeated exceptions that degrade service availability.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to use shell execution, local file handling, environment-dependent behavior, and network access, but the manifest declares no explicit permissions or user-facing consent boundaries. This creates a capability transparency gap: users and hosting platforms cannot accurately assess what the skill may access or transmit, increasing the risk of unintended file writes, network exfiltration, or execution of local commands.

Intent-Code Divergence

High
Confidence
93% confidence
Finding
The documented API endpoints and scenario code describe pet health analysis, which materially conflicts with the advertised purpose of a basic object-detection surveillance skill. This kind of capability mismatch can cause the agent or integrators to invoke unintended backend services, mishandle sensitive data, or deploy the skill under false assumptions about what data is collected and processed.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill exposes a history-listing function (`show_analyze_list`) that is not described in the manifest and is unrelated to single media object detection. Hidden or undocumented data-access capabilities increase the risk of unintended access to prior analysis records, especially because the function takes an identity parameter and could reveal historical metadata or results beyond the current task.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code resolves and uses an internal OpenID/user identity even though the skill is presented as simple media object detection. This creates an undeclared identity linkage and enables access to user-scoped backend operations such as listing prior analyses, which broadens the data exposure surface beyond the expected function of analyzing supplied media.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file exposes generic HTTP proxy-style helpers and CRUD wrappers (http_get/http_post/http_put/http_delete, add/edit/delete) that can send arbitrary requests to caller-supplied URLs. For a skill advertised as basic object detection, this materially exceeds the stated purpose and creates a broad capability surface for unauthorized network access, remote state changes, or abuse by other skill components. The mismatch between manifest scope and implementation makes the code more dangerous because these powerful primitives could be hidden inside an otherwise low-risk surveillance skill.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
The add, edit, and delete methods provide direct remote data modification via POST to arbitrary supplied URLs, despite the skill claiming to perform object-detection analysis. If reachable by agent logic or downstream callers, these methods could be used to alter or delete data in external systems unrelated to image analysis, enabling unauthorized actions under the guise of a benign skill. The context increases severity because write/destructive capabilities are not expected in a basic surveillance-analysis component.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill manifest describes object detection, but this module includes persistent user-account storage and lookup functionality, including usernames, real names, email, birthday, token, and open_token fields. This capability expansion increases privacy and credential-handling risk and may surprise deployers who expected a narrow vision-only skill.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The code creates and maintains a local SQLite database even though the manifest presents a detection-only capability. Hidden persistence changes the skill’s trust boundary by introducing state retention, possible accumulation of sensitive data, and a larger attack surface than users would expect.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file for a basic object-detection skill contains an unrelated `ai_chat` helper that is framed as invoking an external agent. Even though the subprocess call is currently commented out, embedding latent agent-execution capability in a surveillance skill expands the attack surface and creates a risky path for future re-enablement, especially because it accepts arbitrary prompts and generates session identifiers.

Intent-Code Divergence

High
Confidence
88% confidence
Finding
The docstring states that the method invokes an `openclaw agent` via subprocess, while the implementation does not actually do so and instead uses a dummy result path. This discrepancy is dangerous because misleading security-relevant documentation can hide dormant execution features, cause reviewers or integrators to misunderstand runtime behavior, and mask later reactivation of command execution with reduced scrutiny.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This utility file for a basic object-detection skill includes unrelated identity resolution, token handling, backend login/registration, and authenticated API plumbing. That is dangerous because it silently expands the skill's capabilities beyond its declared purpose, enabling account use, token propagation, and backend interaction that users would not expect from local object detection.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code can automatically create or recover backend user accounts by deriving an open-id/username and calling a phoneLogin/register flow without clear user authorization. In the context of a basic object-detection skill, this is especially risky because it creates persistent identities and service access unrelated to detection, which could be abused for unauthorized account creation, tracking, or billing activity.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code reads identity material from workspace data files and persists/reuses identifiers from a local database, establishing long-lived identity state outside the stated needs of object detection. This increases privacy and security risk because identifiers can be silently reused across runs, tied to users, and later transmitted to backend services without clear notice.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
Although comments claim safer logging by avoiding full header output, the debug and exception paths still log URLs, params, request data, response bodies, and error details. Those fields can contain user identifiers, tenant codes, backend messages, or other sensitive operational data, leading to disclosure in logs.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The history-report trigger phrases are broad enough to match ordinary user requests about reports, causing automatic cloud API queries without clear confirmation. In a security-surveillance context, that can expose prior report metadata or cross task boundaries unexpectedly, especially because the skill says history queries must be performed automatically from the cloud.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill states that uploaded attachments and media are automatically saved as local files, but does not present a clear warning or consent mechanism to the user. Automatic persistence of surveillance media can create privacy, retention, and local data exposure risks, particularly on shared or multi-tenant systems.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill requires cloud API usage for history queries and allows remote media URLs that the API service will retrieve, but it does not clearly warn users that their inputs and related metadata may be sent to external services. In a surveillance-analysis workflow, this omission increases privacy and compliance risk because sensitive images, videos, URLs, and report identifiers may leave the local environment unexpectedly.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill accepts remote media URLs and forwards them for analysis without an explicit disclosure that the URL or fetched content may be sent to an external service. In a surveillance context, submitted URLs may point to sensitive internal camera feeds or private media, so silent transmission can cause privacy and data-handling violations even if the backend behaves as intended.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code reads arbitrary local file contents and packages them for upload to a remote analysis service, but this file shows no user-visible disclosure, consent prompt, or path restriction around that exfiltration step. In a skill environment, this can lead to unintentional transmission of sensitive local images/videos or mis-scoped files if callers provide unexpected paths.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The tool sends user-supplied video or URL content to an external analysis service via skill.get_output_analysis without clearly warning the user that potentially sensitive surveillance footage may leave the local environment. In a security-surveillance context, silent transmission can expose personal data, locations, and behavioral information, increasing privacy and compliance risk.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The save function overwrites any provided path silently and suppresses all exceptions, which can hide destructive file writes and make tampering or misconfiguration difficult to detect. If an attacker can influence the path argument or config contents through another part of the system, this enables unauthorized overwrite of application files or security settings.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
When debug mode is enabled, the code turns on low-level HTTPConnection and urllib3 debug logging, which can expose request metadata and possibly sensitive payload/response details. For a surveillance-oriented object-detection skill, this is more concerning because it may handle camera-related data and authenticated API traffic without any user-facing warning about logging.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The request path transmits usernames/open-id values and authentication tokens to remote services without any apparent user-facing notice or consent flow. In a skill advertised as basic object detection, this mismatch makes the behavior more dangerous because users are unlikely to expect identity-bearing network traffic unrelated to detection results.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2