Back to skill

Security audit

Video-based Fall Detection Skill | 跌倒检测视频版技能

Security checks across malware telemetry and agentic risk

Overview

This fall-detection skill performs the advertised cloud video analysis, but it also silently creates or reuses identity records and stores service tokens for later use.

Before installing, treat this as a cloud service connector, not a purely local fall detector. It may upload sensitive home-monitoring videos, query cloud-stored historical reports, create or reuse an internal identity, read a workspace identity file, and store service tokens in a local SQLite database. Install only if you trust the publisher and service endpoints and are comfortable with that persistence and identity-linked cloud processing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
88% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
87% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill manifest describes behaviors that require shell execution, filesystem access, network access, and environment usage, but it does not declare any permissions or constraints. This creates a capability-transparency gap: a user or platform may invoke the skill without understanding that it can run commands and access local/remote resources, increasing the chance of unintended data exposure or unsafe execution.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The script exposes a `--list` path that retrieves historical analysis results via `skill.get_output_analysis_list(open_id=open_id)`, which goes beyond the advertised fall-detection task of analyzing a provided video. This expands the skill into user-history access functionality and may expose prior analysis data if access control is weak or if the OpenID context is mis-bound.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The code resolves a current OpenID and uses it to fetch analysis history, even though the stated skill purpose is fall-detection video analysis rather than identity-linked record access. Binding hidden/internal identity handling to this script increases privacy risk because a caller may trigger retrieval of user-associated data without that capability being obvious from the skill description.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This module exposes broad generic HTTP and CRUD wrapper methods (add, edit, delete, http_get/post/put/delete, page/list) that are not narrowly scoped to fall-detection functionality. In an agent-skill context, such overbroad network primitives can be repurposed to access unrelated backend endpoints or move data outside the intended safety-monitoring workflow, increasing the attack surface and enabling abuse if other components can invoke them with attacker-controlled URLs or payloads.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file provides broad user/account CRUD and shared database access that is unrelated to the stated purpose of fall-detection video analysis. In the skill context, that mismatch materially increases risk because it creates unnecessary data collection and persistence capabilities that could be repurposed for surveillance, identity storage, or cross-skill data access beyond user expectations.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The User model stores identity fields plus token and open_token values, which are highly sensitive and not justified by a fall-detection monitoring feature. If this database is accessed by other components, exfiltrated, or misused through the generic DAO, it could expose authentication artifacts and personal data with significant privacy and account-security consequences.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility code implements remote login/account creation, token management, retry logic, and billing-related behavior that is unrelated to the declared fall-detection purpose. In the context of a safety-monitoring skill, silently creating accounts and transmitting identity/authentication material materially expands the trust boundary and can expose users to undisclosed data sharing, account misuse, and unwanted service coupling.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The code reads, generates, persists, and reuses user identity values such as open-id style usernames outside the skill's stated purpose. For a fall-detection skill, creating durable identifiers without clear necessity or disclosure increases privacy risk and enables cross-session tracking or backend correlation that users would not reasonably expect.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code probes environment variables and filesystem layout to discover agent workspaces, then creates shared data and skills directories. In a fall-detection skill, this broad workspace awareness is not justified by the manifest and increases the ability of the skill to interact with unrelated agent state or persist artifacts outside its narrow functional boundary.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The default trigger rule is broad enough that ordinary discussion of fall detection plus a video attachment could cause automatic execution, including saving files locally and invoking analysis scripts. Overly broad auto-triggering increases the risk of processing sensitive media without clear user intent and can chain into file/network actions unexpectedly.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The history-report trigger keywords are very broad and instruct automatic cloud API queries for prior reports with no stated confirmation or scope checks. In a safety-monitoring context, those historical reports may contain sensitive health-monitoring metadata, so ambiguous triggering can lead to unintended disclosure or access to personal data.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id() without clear user-facing disclosure, and the --open-id / --api-key options are intentionally hidden from help output. This creates a transparency and privacy risk: actions and queries may be attributed to an internal identity the user did not explicitly understand or consent to, especially when listing prior analysis results.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill reads the entire local video file and uploads it to a remote analysis service without any disclosure, consent check, or visible privacy warning in this code path. For a fall-detection use case involving in-home elder monitoring, videos are likely highly sensitive, so silent transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The function reads a sensitive identity value from a local API-key-related file and uses it as an internal identity source without any visible user disclosure or consent flow. This can unexpectedly bind the skill's actions to a local credential context and may leak or misuse identity information beyond the user’s understanding.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The request wrapper automatically attaches tokens, API keys, usernames, tenant codes, and platform metadata to outbound HTTP requests, while also potentially bootstrapping these values from local state. In a fall-detection skill this is especially concerning because users would expect local video analysis or narrowly scoped telemetry, not silent transmission of authentication and identity data to external services.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2