Back to skill

Security audit

Fire & Smoke Detection Skill | 火情烟雾检测技能

Security checks across malware telemetry and agentic risk

Overview

The skill performs cloud-based fire/smoke analysis, but it also silently creates or reuses an identity, sends identifiers to remote services, and stores account tokens locally.

Review this skill before installing, especially in shared or sensitive camera environments. Expect uploaded media and report queries to contact LifeEmergence cloud services, and expect the skill to create local identity state and store service tokens in the workspace data directory. Install only if that account linkage, remote processing, and local credential persistence are acceptable for your deployment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to use shell execution, local file save/read, network access, and environment-backed identity handling, but it declares no corresponding permissions or trust boundaries. This creates a capability mismatch that can mislead operators and policy systems, increasing the chance of unintended file access, remote data transfer, or command execution without explicit review.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The history-list retrieval capability expands functionality beyond the stated fire/smoke detection purpose and may expose prior analysis records tied to an open_id. In a multi-user or weakly isolated environment, this can enable unauthorized metadata disclosure or enumeration of historical jobs that users would not expect from this skill.

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
This file exposes generic add/edit/delete and arbitrary HTTP verb wrappers that are not constrained to fire/smoke detection workflows. In a skill advertised for fire detection, these broad network primitives materially expand capability and could be reused to access or modify unrelated backend resources if higher-level callers pass attacker-controlled URLs or payloads.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The user account lookup helper is unrelated to the stated fire detection purpose and introduces access to identity data within a domain-specific skill. Even if intended for convenience, this unnecessary capability increases the blast radius for misuse, enumeration, or privacy violations when the skill is invoked in broader agent workflows.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The skill is described as fire/smoke detection, but this file implements a generic user/account DAO with persistent local storage and identity handling. That scope mismatch increases risk because it introduces unrelated data-management capabilities that expand the attack surface and may enable covert persistence or collection of user records outside the skill's stated purpose.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The User model stores identity and authentication-related fields including username, realname, email, token, and open_token, none of which are necessary for flame/smoke analysis. Persisting token material in a local SQLite database creates confidentiality and account-takeover risk if the workspace or database file is exposed.

Context-Inappropriate Capability

Low
Confidence
79% confidence
Finding
This DAO automatically creates and redirects database storage with broad mutation capability, which is beyond the declared scope of a detection skill. While not inherently malicious, such persistence infrastructure can be repurposed to retain unrelated state or sensitive data without clear user expectation, increasing privacy and abuse risk.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The shared module exposes a generic `ai_chat`/agent-invocation interface that is unrelated to the advertised fire/smoke detection purpose. Even though the subprocess logic is currently commented out, keeping a latent general-purpose agent interface in common skill code expands the attack surface and creates a pathway for unintended cross-skill capabilities if later enabled or reused.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This utility file performs open-id resolution, local identity persistence, API-key file reading, and automatic user creation logic that is unrelated to a fire/smoke detection skill's declared purpose. That scope mismatch is dangerous because it silently provisions identities and persists account state, increasing privacy, account-abuse, and unauthorized-service-use risk under the guise of a vision skill.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The code issues generic outbound HTTP requests, injects tokens and user identifiers, retries authorization, and can auto-register/login users, which materially exceeds the manifest's fire-detection scope. In context, that makes the skill more dangerous because users would not reasonably expect a camera-analysis skill to perform broad account and API operations behind the scenes.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code inspects environment variables, parses internal workspace layout, and discovers agent-specific data/skills directories, behavior not justified by the stated fire-detection function. This expands access to local execution context and filesystem structure, which can facilitate unauthorized data access or cross-agent contamination if reused elsewhere.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The default trigger is broad enough that ordinary user requests about fire analysis could activate the skill automatically without a clear confirmation boundary. Overbroad activation increases the risk of unintended file handling, network/API use, and execution of side-effecting analysis workflows when the user may only be asking a general question.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The history-report query trigger relies on broad, everyday phrases and is configured to auto-call a cloud API. In context, this is more dangerous than a generic trigger because it may disclose historical report metadata or links tied to an internally managed identity without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill states that uploaded attachments and image/video files will be automatically saved as local files, but this side effect is not prominently disclosed as a user-facing warning. Silent local persistence can expose sensitive surveillance material to retention, misuse, or later unauthorized access on the host system.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill describes remote warning pushes and cloud/API-driven processing but does not provide a clear privacy and integrity warning about external transmission of potentially sensitive monitoring content or metadata. In a surveillance/fire-detection context, undisclosed outbound transfer can expose operational details, locations, or live incident data to third parties.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code resolves an internal user identity via OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) even though the open-id argument is hidden from normal help output and the comment explicitly states the user is not required to input it. This creates undisclosed identity handling in a CLI tool, which can surprise users, enable unintended attribution or access to per-user analysis records, and weaken transparency and consent around identity-bound operations.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
When given a local path, the skill reads the entire file and uploads its contents to the backend analysis service without any disclosure, consent gate, or visible notice in this code path. In a security/privacy context, this can cause unintended exfiltration of sensitive images or videos, especially in industrial or surveillance deployments where media may contain confidential scenes, people, or facility details.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The code silently creates database files and redirects storage locations without any user-visible notice or consent. In the context of a fire-detection skill, undisclosed local persistence is more suspicious because users would not reasonably expect unrelated stateful storage behavior, especially when it can retain identity or token data.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
Automatic schema alteration modifies existing local databases on startup without any visible warning, review gate, or backup flow. Silent schema mutation can unexpectedly expand stored data, break assumptions, and complicate forensic review, especially in a skill whose stated purpose does not require account-database migration logic.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
When debug mode is enabled, HTTPConnection and urllib3 debugging are turned on globally, which can expose request and response metadata and potentially secrets in logs. Even though later prints try to truncate headers, library-level debug logging can still leak sensitive network content without clear user disclosure.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The code reads an API-key-related file from the workspace data directory to derive identity information without any visible notice or consent flow. In a fire-detection skill, silent use of locally stored credentials or identifiers is unexpected and creates privacy and transparency concerns even if it is not directly exploitable on its own.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This code automatically transmits user identifiers, tokens, tenant metadata, and platform/skill hub information during network calls, with no explicit user warning in the skill context provided. Because the skill is presented as fire/smoke detection, covert transmission of identity and account metadata is more concerning and can violate user expectations and privacy boundaries.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2