Back to skill

Security audit

Driver Head-Pose Abnormality (Head-Down / Side-View) | 驾驶员头部姿态异常(低头/侧视)检测

Security checks across malware telemetry and agentic risk

Overview

This skill performs the advertised driver head-pose video analysis, but it also silently creates or reuses identities, stores tokens locally, uploads sensitive driver media to a remote service, and can query account-linked historical reports.

Install only if you are comfortable sending driver face videos or URLs to the configured remote service and having the skill silently create or reuse a local identity, store service tokens in the workspace data directory, and retrieve account-linked historical reports. Use it in environments with explicit driver consent, controlled workspaces, and a plan for deleting local database/token data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
75% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
75% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares no permissions, yet its documentation instructs use of shell execution, local file handling, environment-derived identity handling, network access, and output file writing. This creates a hidden-capability mismatch that can mislead operators and policy engines, allowing a seemingly simple vision skill to execute broader actions such as cloud queries and local persistence without transparent consent boundaries.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill’s stated purpose is real-time head-pose analysis, but the documentation expands behavior into cloud-based historical report querying and report-link retrieval. This scope expansion increases data exposure and creates an unexpected path to access potentially sensitive prior driver-monitoring records beyond the immediate analysis task.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
Automatic creation and reuse of a default local user identity introduces hidden state and implicit account binding unrelated to simple head-pose detection. In a privacy-sensitive context involving biometric driver video and historical records, silent identity fallback can cause cross-user data mixing, unauthorized report access, and poor auditability.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill metadata describes real-time head-pose analysis, but the CLI also exposes a historical listing function through --list that can return prior analyses for an open_id. This is a scope-expansion and data exposure issue because users and reviewers may not expect the tool to enumerate stored analysis results, especially in a driver-monitoring context involving potentially sensitive behavioral data.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS video URLs even though the manifest describes an in-cabin DMS camera use case. This expands the trust boundary and can cause the backend to fetch attacker-controlled URLs, creating SSRF-style exposure, unexpected data ingestion, or privacy violations if internal or sensitive resources are reachable by the downstream analysis service.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The history-listing capability exposes prior analysis records via `skill.get_output_analysis_list(open_id=open_id)` even though the stated purpose is real-time driver monitoring. In a driver-monitoring context, stored analysis history can reveal sensitive behavioral or video-derived information, and this extra feature increases the attack surface for privacy leakage or unauthorized enumeration if access control around `open_id` is weak.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
This file exposes broad generic network capabilities including add/edit/delete and arbitrary HTTP GET/POST/PUT/DELETE wrappers that are not constrained to the stated head-pose analysis function. In an agent skill context, such overbroad API surface can be abused by other components or prompts to perform unintended external actions, increasing the risk of data exfiltration, unauthorized state changes, or misuse of backend services.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The module implements broad user/account persistence and mutation capabilities that are unrelated to the declared head-pose distraction-analysis function. In skill context, this scope mismatch is suspicious because it increases the data-handling surface and enables storage and modification of user records without a clear operational need.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The User model stores identity and authentication-related fields including username, realname, email, token, and open_token in a local SQLite database, which is not justified by a head-pose monitoring skill. In this context, collecting and persisting such sensitive data creates unnecessary exposure of credentials and personal information if the local workspace is accessed, copied, or reused by other components.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file contains generic remote account provisioning, token management, and authenticated API request logic that is unrelated to the stated head-pose/DMS analysis purpose. This materially expands the skill's privileges and enables silent outbound communication, identity use, and token-backed operations beyond what a user would reasonably expect from an in-cabin analysis skill.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The code automatically resolves an identity by reading local state and, if absent, generates and persists a synthetic user identity without user interaction. This creates durable identifiers and enables subsequent remote actions under a fabricated or implicit identity, which is not justified by the skill's described local head-pose monitoring function.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The utility inspects environment variables, script paths, and workspace layout to determine agent context and writable directories. Although not inherently malicious, this capability is broader than needed for the declared DMS function and can facilitate environment discovery, data placement, and cross-workspace interactions in ways users would not expect from a vision-analysis skill.

Vague Triggers

Medium
Confidence
82% confidence
Finding
A default trigger that activates on any uploaded DMS driver-face video is too broad for a skill that can also save files, invoke scripts, and query cloud history. Over-triggering increases the chance of unintended processing of sensitive biometric video and may execute privileged actions without sufficiently specific user intent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The keyword trigger list is broad and lacks guardrails, so common terms related to driving safety or head pose could invoke the skill unintentionally. In this skill’s context, accidental invocation is more dangerous because it may process biometric video, persist local files, and access cloud-backed historical records tied to a hidden identity model.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The API documentation exposes a full report export endpoint but does not mention access-control expectations, sensitivity of report contents, or privacy/compliance considerations. In a driver monitoring context, exported reports may contain behavioral telemetry and potentially identifiable data, increasing the risk of over-collection, unauthorized sharing, or insecure downstream handling.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code initializes an internal identity via OpenIdUtil.resolve_current_open_id using a hidden --open-id parameter and suppresses user-facing disclosure. In a monitoring system handling driver-behavior analysis, hidden identity binding increases the risk of silent tracking, unexpected association of results with a user identity, and unauthorized access to stored records when combined with listing functionality.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The code reads any permitted local file and uploads its full contents to the analysis service without any user-facing confirmation in this path. In a security context, this can lead to inadvertent exfiltration of local data if a user supplies the wrong path or if another component passes sensitive files into the skill.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads an identity value from data/smyx-api-key.txt and uses it as an internal identifier without any visible disclosure or consent flow. This can silently bind the skill's actions to a local credential or identity source, surprising users and increasing privacy and account-misuse risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The request wrapper assembles and transmits user identifiers, access tokens, API keys, and other metadata in outbound requests, while the skill description gives no indication of such account-linked network activity. In the context of a driver head-pose analysis skill, this hidden data transmission is especially concerning because the advertised function suggests local sensor processing, not remote identity-bound service interaction.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2