ClawHub
Back to skill

Security audit

Acquaintance Recognition & Analysis Skill | 熟人识别分析技能

Security checks across malware telemetry and agentic risk

Overview

This face-recognition skill should be reviewed carefully because it silently creates or reuses an account identity, stores tokens locally, and sends biometric media and history requests to external services.

Install only if you are comfortable sending face images, videos, media URLs, identity-linked request metadata, and report-history queries to the Life Emergence/SMYX remote services. Before use, confirm whose account identity will be used, where tokens are stored, how uploaded biometric data and reports are retained or deleted, and whether users or bystanders have consented.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
The list() method applies filters using getattr(self.__model__, key) where key comes from the caller-supplied filters dictionary. Although this is not classic SQL injection because SQLAlchemy still parameterizes values, unvalidated attribute selection can let callers query on unintended model attributes, trigger exceptions, or bypass intended business restrictions by filtering on sensitive/internal columns.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
The count() method repeats the same pattern of caller-controlled dynamic attribute access for filters. This can expose internal schema details through error behavior and enable unauthorized querying against columns that were not meant to be externally filterable.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The manifest declares no permissions even though the skill instructions clearly require shell execution, local file handling, network access, and likely environment/config access. This creates a transparency and policy-enforcement gap: reviewers and runtime controls may underestimate what the skill can actually do, increasing the chance of unauthorized data access or outbound transmission.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose is face recognition and enrollment, but the described behavior indicates hidden identity lifecycle management, remote authentication/registration, token persistence, and report-link generation that are not disclosed as primary functions. That mismatch is dangerous because users and integrators may provide sensitive biometric media without realizing the skill also creates accounts, stores credentials/tokens locally, and transmits data to remote services.

Description-Behavior Mismatch

High
Confidence
90% confidence
Finding
The implementation does not align with the advertised purpose of familiar-person recognition; instead it behaves as a generic video analysis and history-listing client via skill.get_output_analysis and skill.get_output_analysis_list. This mismatch is security-relevant because users may provide sensitive surveillance or identity-verification footage under the belief that processing is limited to a narrow face-recognition use case, while the code exposes broader analysis behavior and account-linked history access.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The skill exposes a generic username-based user lookup method that is broader than its declared familiar-person recognition purpose. In a biometric/identity-verification context, this expands access to identity data and can enable user enumeration or retrieval of unrelated account information if downstream controls are weak.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The file provides broad generic HTTP CRUD wrappers and paging helpers that can call arbitrary endpoints, which exceeds the stated face-recognition functionality. In a skill handling sensitive biometric and location-linked identity data, such generic transport primitives increase the attack surface and make it easier for other components to perform unintended data access or modification using this shared service.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This file adds a generic `ai_chat` capability to a skill that is supposed to perform familiar-person recognition, expanding the skill beyond its declared purpose. Even though the subprocess invocation is currently stubbed/commented out, the presence of a general agent interface creates an unnecessary execution and data-handling surface that could later be wired to external model or command execution without proper controls.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
The docstring states that the method invokes `openclaw agent` through `subprocess`, but the implementation does not do that and instead uses a dummy `result` object. This mismatch is dangerous because it misleads reviewers and operators about what code is actually running, undermines trust in security review, and can conceal incomplete or later-swapped execution paths.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This utility code automatically creates or resolves user identities, performs silent phone-login style provisioning, and persists tokens/open tokens in local storage unrelated to the declared face-recognition purpose. In a biometric/identity skill, silently binding operations to a hidden account materially increases privacy and account-abuse risk because users may not realize identities and long-lived credentials are being created and reused.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The history-report trigger phrases are broad enough to match ordinary user requests, which can cause the skill to invoke cloud report-listing behavior unexpectedly. In a biometric/identity context, unintended activation may expose historical recognition metadata or cause unnecessary transmission of identity-linked queries to a remote API.

Vague Triggers

Medium
Confidence
74% confidence
Finding
The default activation rule is overly ambiguous and says the skill should trigger whenever a user needs to identify acquaintances in monitoring footage, without clear exclusions or consent boundaries. For face-recognition workflows, ambiguous auto-activation increases the risk of processing sensitive biometric data when the user did not clearly intend to invoke this capability.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill processes biometric face data and identity information but does not present a clear privacy warning, consent requirement, or data-handling disclosure. In this context, missing privacy notice is especially risky because face images, identity labels, locations, and historical reports are highly sensitive and may be regulated personal data.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script includes a hidden `--open-id` parameter and silently resolves account context via `OpenIdUtil.resolve_current_open_id(...)` without clear user disclosure or consent. In a biometric recognition skill that can list or retrieve familiar-person analysis results, hidden identity scoping increases the risk of querying or acting on another user's data context, which can lead to privacy violations, unauthorized access, or confusing cross-account behavior.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code reads arbitrary local file contents into memory and sends them to the backend analysis service via the `files` parameter, but this file contains no user-facing disclosure, consent check, or data-minimization control before transmission. In a face-recognition skill handling videos/images that may contain biometric data and bystanders, silent upload materially increases privacy and compliance risk because sensitive local media can be exfiltrated to a remote service without explicit informed consent.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The skill forwards user-supplied remote URLs directly to the analysis service as `videoUrl` without any visible notice to the user about external retrieval or downstream processing. In this facial-recognition context, that can cause third-party systems to fetch and process potentially sensitive surveillance media, exposing private locations, identities, and access patterns to external services.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code accepts a local file path or remote URL and sends it to a backend analysis service through skill.get_output_analysis without any explicit user-facing notice, confirmation, or privacy warning. In the context of a face-recognition skill for homes and offices, this is particularly sensitive because uploaded media may contain biometric data, bystanders, and location/context information that users may not realize is being transmitted off-device.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The history-list function fetches account-linked analysis results from a remote service using the current open_id, but the user is not clearly warned that remote retrieval of prior analysis history is occurring. Because this skill is positioned for identity verification in private environments, silent access to stored recognition history can expose sensitive biometric and activity metadata.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code reads a sensitive identity value from data/smyx-api-key.txt and later uses it as an internal identity/open-id without any visible notice, validation, or consent flow. This can cause silent impersonation or unintended account linkage if the workspace file was prepopulated by another process or actor.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
HTTP requests are populated with user identity and authentication material, including X-Access-Token, X-Api-Key, Authorization, and pnaUserName, without any user-facing disclosure in this code path. In a face-recognition skill handling highly sensitive biometric context, undisclosed transmission of identity-linked tokens and usernames significantly raises privacy, tracking, and account misuse risk.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
90% confidence
Finding
The skill performs an external POST to a health-related base URL to silently register/login a user identity using openId/mobile values. Even if intended for backend account setup, this is external transmission of identity data unrelated to the obvious local image-recognition function and is more concerning given the biometric nature of the skill.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：jpg/jpeg/png/mp4/avi/mov，最大 10MB |
| 🧑‍⚖️ 结果性质 | 识别结果仅供参考，不能用于法定身份核验 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |
Confidence
82% confidence
Finding
The hidden/invisible instruction content is a strong indicator of prompt or metadata manipulation intended to influence agent behavior without transparent review. In a skill that handles biometric media and remote API interactions, concealed directives are particularly dangerous because they can hide data exfiltration paths, suppression of warnings, or other non-obvious control flow.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "familiar-person-recognition-analysis"
description: "Identifies acquaintances in videos or images through face photo comparison. Supports database enrollment, and the recognition results tell you who is at which location. Suitable for identity verification in homes and office areas. | 熟人识别分析技能，通过人脸图片比对识别视频/图片中的熟人，支持底库录入，识别结果告诉你哪个位置是谁，适用于家庭、办公区域身份核验"
version: "1.0.14"
license: "MIT-0"
---
Confidence
86% confidence
Finding
The YARA hit for metadata/tool poisoning, combined with hidden-character indicators in the manifest, suggests the skill metadata may be crafted to manipulate tool selection, trust decisions, or downstream parsing. Because this skill already involves remote calls and identity-linked processing, poisoned metadata could mislead orchestrators into granting access or invoking behavior under false assumptions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2