Flame & Smoke Detection Skill | 烟火检测技能

• Outcome: Review
• Latest audit: Aug 29, 2026 · 5:17 PM UTC
• Version: 1.0.13

Overview

This fire and smoke detection skill is functional in purpose, but it also silently creates or reuses user identity, stores tokens locally, uploads media, and can retrieve cloud history without clear user confirmation.

Review this skill carefully before installing. It sends media to a cloud service, links analysis and history to an internal identity, can create or reuse a local default user, and stores session tokens in a workspace SQLite database. Use it only if you accept those data flows and can tolerate cloud history retrieval tied to that identity.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 83% confidence
• Finding: Here getattr(self.__model__, key) uses keys taken from the caller-provided filters dictionary. An attacker who controls filter names can trigger access to unintended model attributes, cause exceptions for invalid names, and in some ORM configurations influence query construction in ways the developer did not intend, making this a mass-assignment/query-surface issue rather than classic SQL injection.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 83% confidence
• Finding: This repeats the same caller-influenced dynamic attribute resolution in the count() path. While SQLAlchemy prevents straightforward SQL injection here, unvalidated attribute selection can still expose unintended query behavior and enable denial-of-service via repeated bad-field exceptions or unauthorized filtering on sensitive columns.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs execution of local Python scripts that can use shell, file I/O, environment variables, and network access, but it declares no permissions or trust boundaries. That mismatch can cause the host agent to run code with broader capabilities than users or reviewers expect, increasing the chance of unintended data access, outbound requests, or filesystem modification.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documented endpoints and scenario code describe a pet health analysis API, which is inconsistent with a fire/smoke detection skill. This kind of capability/documentation mismatch is dangerous because integrators or downstream agents may call the wrong backend, expose unrelated sensitive data, or make security decisions based on incorrect assumptions about what the skill does.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill exposes a history/listing function for prior analyses via `show_analyze_list(open_id)` that is outside the advertised fire/smoke detection purpose. Even though `open_id` is currently sourced internally, this creates a secondary data-access surface that could reveal prior analysis metadata or results without clear user disclosure or authorization checks in this file.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code initializes internal identity handling (`OpenIdUtil.resolve_current_open_id`) and then uses `ConstantEnum.CURRENT__OPEN_ID` to access analysis listings, which is unrelated to simple media scanning. Hidden identity resolution increases the risk of silent cross-user data access or use of privileged internal context without transparent user awareness.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The CLI claims to accept MP4 video files and MP4 URLs, but it forwards arbitrary local paths or URLs to the backend without validating scheme, type, or format. In a networked analysis pipeline, this can enable unintended backend access to internal resources, unsupported file handling, or abuse of downstream processors if they trust the client-side constraints.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This file exposes broad generic request primitives and CRUD-style helpers (http_get/http_post/http_put/http_delete, add/edit/delete/page/list) that can call arbitrary URLs, which exceeds the narrowly stated fire/smoke detection purpose. In an agent skill context, this expands the reachable attack surface and can enable unintended data access, proxying to internal or external services, or misuse of the skill as a general network/API client if higher layers pass attacker-controlled endpoints or parameters.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file defines a generic user DAO and local database CRUD layer, including account lookup and update behavior, which is unrelated to a fire/smoke detection skill's stated purpose. Capability mismatch increases risk because it expands the attack surface and enables local persistence of user/account data without a clear business need in this skill context.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The User model stores personal profile fields and authentication-like material including token and open_token, which are unnecessary for fire/smoke detection. If this local SQLite database is read or copied, it could expose credentials and personal data, creating privacy and account-compromise risk disproportionate to the skill's purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility performs broad account/session initialization, token handling, local user lookup, remote login, and automatic retry logic that are unrelated to a fire/smoke media analysis skill. In this context, the code expands the skill's authority to identify users, create accounts, and communicate with external platforms, creating unnecessary data exposure and unauthorized side effects.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can generate default open IDs, create local user records, and persist them for reuse even when no explicit user identity was provided. For a fire/smoke detection skill, silent identity creation is unjustified and can lead to unauthorized account provisioning, incorrect attribution, and privacy issues if actions are later tied to these synthetic identities.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The utility inspects agent workspace layout, reads OPENCLAW_WORKSPACE, locates data directories, and reads a workspace identity file (smyx-api-key.txt). For a media detection skill, this exceeds functional necessity and creates an information boundary issue by allowing the skill to discover environment structure and consume identity material from local workspace state.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill auto-triggers cloud history-report queries from broad natural-language phrases like viewing report lists or history, which may be invoked unintentionally in normal conversation. This can cause unnecessary disclosure of potentially sensitive historical analysis data tied to an internal identity without a clear confirmation step.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill states that uploaded attachments and media files are automatically saved locally, but it does not warn users about retention, storage location, access controls, or deletion behavior. For surveillance and fire-monitoring scenarios, those files may contain sensitive images or video, so silent persistence increases privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Sensitive internal identity is resolved and consumed without user-facing disclosure, which undermines transparency and least-privilege expectations for a media-analysis skill. In context, the hidden identity becomes more dangerous because it is tied to the `--list` path that may expose prior analysis records, creating a privacy and access-control concern beyond the core detection function.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When a local path is provided, the skill reads the entire file and uploads its contents to a remote analysis API, but this code does not present any warning, consent step, or disclosure to the user at the point of transfer. In a surveillance or fire-detection context, uploaded videos/images may contain sensitive footage, creating a real data-exfiltration and privacy risk if users assume processing is local or do not understand that third-party transmission occurs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Enabling HTTPConnection debug logging and urllib3 debug output can expose full request/response metadata, including headers, bodies, tokens, and user data, to logs. Even if gated by a debug flag, this is dangerous without strong safeguards because debug mode is often enabled in development or troubleshooting and logs can be retained or shared.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This code automatically assembles and transmits identity fields such as openId, mobile, and source to a remote endpoint without an explicit user-facing consent or disclosure step. In the context of a fire/smoke detection skill, silent transmission of identity data is unnecessary and increases privacy and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 93% confidence
• Finding: The requests.post() call sends user identity information to an external service for phoneLogin/registration. External transmission is particularly concerning here because the skill's stated purpose is fire/smoke detection, not account onboarding, so the network disclosure is out of scope and may surprise users.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2