Time-Lapse Album Custom Summarization Skill | 时光相册自定义浓缩分析技能

• Outcome: Review
• Latest audit: Aug 13, 2026 · 1:34 AM UTC
• Version: 1.0.10

Overview

This video highlight skill sends media to cloud services and silently creates/reuses an account identity with locally stored tokens, without enough user control or disclosure.

Review before installing. Do not use this skill on sensitive or regulated footage unless you are comfortable with cloud upload, account-linked processing, silent identity creation, local token storage, and cloud history retrieval. The current custom target/keyword option should not be trusted to limit what the backend analyzes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 83% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 83% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises no explicit permissions while its documented behavior includes shell execution, local file handling, network access, and environment use. This creates a transparency and consent problem because the agent may invoke powerful capabilities that users and platform controls are not clearly warned about.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is video highlight generation, but the behavior reportedly includes silent identity creation, token persistence, backend authentication, and remote history retrieval. That mismatch is dangerous because it hides account-linked data processing and credential/state management behind a media-analysis façade, undermining informed consent and increasing privacy and abuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The function accepts a user-supplied keyword/target description via the text parameter but then ignores it and only passes the input path/URL to skill.get_output_analysis(). This creates a security-relevant integrity issue: users may believe extraction is constrained to specific targets when it is not, causing over-collection, unintended analysis of unrelated content, and misleading downstream decisions based on false assumptions about what was processed.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The CLI advertises custom target/keyword extraction and emits guidance encouraging use of --text, but the implementation does not use that input. This is dangerous because it can mislead operators into trusting that sensitive video processing is scoped or filtered when the tool may instead analyze the full source, increasing privacy and compliance risk in a media-analysis skill context.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: This file exposes generic CRUD and arbitrary HTTP wrapper methods (`http_get`, `http_post`, `http_put`, `http_delete`, plus `add/edit/delete/list/page`) that are not constrained to the stated timelapse/video-highlight purpose. In an agent skill context, these broad network primitives can be repurposed to contact unintended internal or external services, expand the skill’s effective permissions, and enable data exfiltration or unauthorized API interaction beyond the manifest’s declared behavior.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is described as video timelapse analysis, yet this file defines persistent user-account storage and lookup logic. That mismatch increases the risk of covert or unnecessary collection of user-identifying data, especially because the capability is unrelated to the declared functionality and therefore harder for users and reviewers to anticipate.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The model stores token and open_token fields in a local SQLite database despite no clear need in a timelapse-analysis skill. Persisting authentication material expands the blast radius of any local file compromise, enables credential reuse or impersonation, and is especially suspicious given the mismatch between declared skill purpose and stored secrets.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This utility file contains authenticated remote API access, token handling, and automatic account provisioning logic that is unrelated to a timelapse/video-highlights skill. In this context, hidden networked identity-management behavior materially expands the skill's capabilities and can transmit user identifiers, tokens, and activity to external services without being necessary for the declared function.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can resolve, create, and persist default open IDs and local user records automatically when none are provided. For a video highlight skill, silently creating identities is unnecessary and risky because it enables tracking, impersonation of a synthetic user context, and unintended account linkage to remote services.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The code inspects agent workspace layout, derives root paths, and creates data/skills directories outside the immediate needs of timelapse processing. This increases filesystem reach and creates a foundation for broader persistence or modification of the agent environment than the stated skill purpose suggests.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The default trigger is broad enough that ordinary requests related to videos or summarization may activate the skill without clear user intent. In an agent setting, overbroad activation can cause unintended file processing, network transmission, or account-linked operations.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The history-query trigger relies on common phrases like viewing reports, which may unintentionally cause remote retrieval of prior analysis records. Because those records may be tied to silently managed identities, accidental activation increases privacy exposure and data leakage risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The workflow says uploaded attachments or media are automatically saved locally, but this is not clearly disclosed as a user-facing privacy and storage behavior. Automatic local persistence can expose sensitive personal media to unintended retention, later access, or cross-task reuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that remote URLs are passed to an API service which downloads the content, but this external data transfer is not prominently disclosed as a privacy and security boundary. Sending user-provided URLs to a backend can reveal browsing targets, trigger processing of sensitive content, and create SSRF-like concerns if backend validation is weak.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill reads the entire local file and uploads its contents to an external analysis API without any visible consent, warning, or disclosure in this code path. For a video-analysis skill, this creates a real privacy and data-handling risk because users may unknowingly transmit sensitive media, metadata, or regulated content off-device.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Debug mode enables low-level HTTPConnection and urllib3 logging, which can expose request URLs, parameters, bodies, and possibly authentication material in logs. Because this file also handles tokens and identity-related requests, verbose logging is especially sensitive in this skill context.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: Automatically creating a skills directory is more sensitive than creating a data directory because it touches the agent's executable/installed-skill area. In a timelapse-analysis skill, modifying or preparing skill installation locations is out of scope and can facilitate persistence or later code placement in the agent environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This logic persists a generated default open-id and corresponding local user data without explicit user action. Persistent identity creation in a skill unrelated to account management can enable covert tracking across sessions and external API interactions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request wrapper automatically injects user identity, tenant, skill metadata, and authentication headers into outbound HTTP requests. In a video-analysis skill, this hidden transmission of identity and auth context is dangerous because it broadens data sharing beyond the user's likely expectations and couples media operations to account-level telemetry.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：mp4/avi/mov，最大 500MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供整理使用，请注意保护个人隐私 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 71% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "custom-timelapse-analysis"
description: "Generates condensed album highlights based on specified keywords or targets. It extracts specific target segments from long videos and compiles them into an exciting summary. | 时光相册自定义浓缩分析技能，基于指定关键词/目标生成时光相册浓缩集锦，从长视频中提取特定目标片段，整理生成精彩汇总"
version: "1.0.13"
license: "MIT-0"
---

• Confidence: 80% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2