Smart E-Bike Detection Skill | 电动车智能检测技能

• Outcome: Review
• Latest audit: Aug 16, 2026 · 10:26 PM UTC
• Version: 9.9.14

Overview

The skill mostly matches its electric-vehicle detection purpose, but it sends surveillance media and identity-linked data to external/default dev endpoints while silently creating and storing account credentials.

Review this skill before installing. Use it only if you are comfortable sending images, videos, and media URLs from surveillance contexts to the configured backend, and with the skill creating/reusing a local identity record and storing service tokens in the workspace data area. Verify the intended API endpoints first, because the bundled config selects a dev environment with private HTTP addresses, and avoid sensitive footage unless you have appropriate consent, retention, and legal controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and instructs use of shell execution, local file handling, network access, and implicit identity handling, but declares no permissions or trust boundaries. This creates a capability/permission mismatch that can cause the agent to perform sensitive actions without explicit user awareness or policy gating, especially for file uploads and cloud API access.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script exposes a hidden `--list` capability that retrieves prior analysis records via `show_analyze_list(open_id)` and binds that behavior to an internal/open ID identity flow. That exceeds the stated purpose of local EV detection and creates a data-access surface that could disclose historical analysis data or metadata if invoked inappropriately or without clear authorization controls.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill accepts arbitrary http/https URLs and forwards them to the backend analysis service, which expands the trust boundary beyond local computer-vision processing described in the skill metadata. This can enable backend-side fetching of attacker-controlled URLs, creating SSRF-like exposure, unexpected network access, or privacy issues if users assume only local files are analyzed.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The skill provides report-listing and export-link generation features that go beyond the stated detection/counting/alerting scope, increasing data exposure surface. If access control is weak in surrounding components, this functionality could reveal prior analysis records or direct export URLs not expected by users of this skill.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This file exposes a generic API wrapper with broad CRUD and arbitrary HTTP GET/POST/PUT/DELETE capabilities that are not constrained to the stated electric-vehicle detection purpose. In a skill whose manifest claims narrow computer-vision violation analysis, this creates an unnecessary expansion of privilege and can enable unauthorized backend interactions, data access, or repurposing of the skill as a general network client if other components pass attacker-controlled URLs or parameters.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The username-based account lookup introduces identity-related capability that is unrelated to EV detection and violation counting. In this context, it increases the attack surface for user enumeration or unauthorized retrieval of user information, especially if exposed to untrusted inputs or combined with the generic HTTP service methods in the same module.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This code creates, resolves, and persists user identities outside the EV-detection function, including reading an internal identity from a workspace file and generating default accounts stored locally. In the context of a computer-vision parking/detection skill, hidden identity provisioning is unrelated functionality that can silently bind user activity to local or remote accounts and expands the attack surface for tracking, impersonation, and unauthorized service use.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The HTTP client performs remote login/registration, token recovery, token persistence, and authenticated outbound requests that are not inherent to EV image analysis. Because the skill description is narrowly about local/object detection, this hidden network/auth behavior is especially risky: it can transmit identifiers and tokens to external services, create accounts automatically, and operate under silently recovered credentials.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The workspace-discovery logic locates agent roots and automatically creates data/skills directories, which is broader system-management behavior unrelated to EV detection. In this context, such code increases the skill's ability to inspect and modify agent-local filesystem layout, making later persistence, cross-skill interference, or unanticipated data storage easier.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The history-report query is triggered by broad natural-language phrases such as requests to view reports or records, without strong scoping or confirmation. This can cause the agent to retrieve cloud-backed historical data when a user meant something more general, leading to unintended disclosure of prior reports tied to an internal identity.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The detection activation rules rely on broad keywords like e-bike, restricted area, or parking-related terms plus an uploaded file, which risks accidental invocation on unrelated media. In a multimodal skill that uploads content to a remote API, overbroad activation increases the chance of unintended data processing and transmission.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that local files are saved and that media URLs are passed for API-side download, but it does not clearly warn users that their uploaded files and remote media links will be transmitted to a cloud API for analysis. This is a meaningful privacy and data-governance issue because surveillance footage and images can contain sensitive personal information and location data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code resolves a hidden identity parameter through `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` without meaningful user disclosure, and then uses identity-linked state in the hidden listing flow. Hidden identity handling reduces transparency and can enable unintended data association or access to per-user records, especially in a tool whose declared purpose is media detection rather than account-scoped data retrieval.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code reads local file contents into memory and uploads them, or forwards remote video URLs to an external analysis service, without any visible user warning or consent indicator in this file. For a surveillance-oriented skill processing images/videos, this is sensitive because users may unknowingly transmit private or regulated footage off-device.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The CLI accepts a local file path or remote URL and forwards it to backend analysis via skill.get_output_analysis() without any explicit notice, consent prompt, or clear indication that user-provided media references may be transmitted to a remote service. In a video surveillance context, those inputs may reveal sensitive footage locations, internal file paths, or cause external retrieval of remote content, creating privacy and data handling risk even if this appears to be intended functionality.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The loader will create directories and write a new config file automatically when the target path does not exist, and all exceptions are silently suppressed. Silent file creation can modify the runtime environment without operator awareness, making forensic review harder and potentially allowing unexpected persistence or unsafe writes if the path is influenced by untrusted inputs elsewhere.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code performs automatic schema migration on the persistent sys_user table at initialization, modifying stored user-data structures without any validation, backup, consent, or migration versioning. In a skill whose declared purpose is EV detection, silently altering a user database increases privacy and integrity risk and can unexpectedly expand retained personal data fields such as realname and source_id.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function silently reads an identity value from data/smyx-api-key.txt without a user-facing disclosure or consent flow. In a vision-analysis skill, undisclosed ingestion of local identity material is dangerous because it can cause the skill to assume an existing identity and make subsequent remote requests or actions on the user's behalf.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code automatically creates agent data directories and supports later creation/persistence of local user records without transparent disclosure. While not immediately catastrophic alone, it establishes hidden state and persistence mechanisms unrelated to detection, which can surprise users and facilitate stealthy account or telemetry behavior across runs.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section sends outbound HTTP requests with identity-bearing fields and authentication headers, but there is no clear user-facing warning or consent mechanism. In a skill advertised for EV detection, covert transmission of pnaUserName, tokens, openId/mobile, and related metadata is particularly concerning because users would not reasonably expect account-linked network activity from image analysis code.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2