Flame & Smoke Detection Skill | 烟火检测技能

• Outcome: Review
• Latest audit: Oct 13, 2026 · 10:04 AM UTC
• Version: 1.0.17

Overview

This skill performs cloud fire and smoke analysis, but it silently manages an online identity and stores service tokens locally, so it should be reviewed before installation.

Install only if you are comfortable sending fire/smoke images, videos, or submitted URLs to the Life Emergence cloud service and allowing the skill to create/reuse a local identity with stored service tokens. Avoid using it with private camera URLs or sensitive surveillance footage unless the publisher's data handling and account model are acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (53)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding describes authenticated outbound HTTP requests, credential-like local file reads, default open-id generation, token persistence, and automatic remote login/registration, none of which are disclosed by the skill’s core description. This is highly risky because it combines hidden identity handling with networked account actions and local secret access, potentially exposing credentials and linking user activity without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The API documentation is clearly for a pet health analysis service while the skill is labeled as fire/smoke detection. This mismatch can cause integrators or downstream agents to call the wrong endpoints, process the wrong data types, or expose unrelated backend capabilities, which is especially risky in safety-critical fire warning workflows where incorrect results or failed alerts could have real-world consequences.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file defines generic user persistence capabilities, including identity records and account selection logic, which are unrelated to the declared fire/smoke detection purpose. In a mismatched skill context, unexplained user/account management increases the risk of hidden data collection, cross-skill state abuse, and unauthorized handling of personal information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The User model stores usernames, real names, email, birthday, token, and open_token, which is excessive and unjustified for a fire/smoke detection skill. Storing authentication tokens and personal data in a local SQLite database creates unnecessary credential and privacy exposure, especially if the database is shared across agent workspaces.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The utility layer automatically provisions or logs into remote user accounts, retrieves tokens, and persists them locally as part of generic HTTP handling. For a fire/smoke detection skill, this is unnecessary privilege and identity management behavior that silently transmits identity material and expands the blast radius if the host, logs, or local database are compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares executable behaviors such as shell invocation, file operations, network access, and environment usage, but does not scope or constrain those capabilities via explicit permissions or allowed-tools metadata. This increases the chance of overbroad execution in a host agent, especially because the workflow instructs direct script execution and remote API access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest description and the document consistently present bilingual Chinese/English output conventions, but there is no statement that the user can choose their preferred language or locale. Under the policy, forcing a specific language format without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill says it 'defaults' to activating whenever a user provides a monitoring video/image URL or file needing fire/smoke detection, but it does not clearly define how that need is determined or what distinguishes this skill from other image/video analysis skills. The keyword list is also broad and lacks negative examples, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The auto-trigger list includes generic phrases such as '查询历史报告' and '显示所有检测报告', which are broad enough to match ordinary conversation without clearly limiting them to this specific fire/smoke skill context. The description does not provide exclusion conditions or negative examples to distinguish when the history-query function should not activate.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes a hidden history-listing capability via show_analyze_list(open_id) that is unrelated to the advertised fire/smoke analysis function. Because it operates on a user identity value and the open_id validation is commented out, this expands the skill’s data-access surface and could enable retrieval of prior analysis records if identity handling or authorization in downstream code is weak.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code defines command descriptions and help text entirely in Chinese, and additional runtime output is also Chinese-only. That imposes a specific language on users without offering any locale selection or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script resolves an internal OpenID identity at startup even though the skill is presented as a media-analysis tool. This implicit identity resolution introduces unnecessary identity coupling and creates risk of silent account-context binding, which may be used to access user-scoped data such as analysis history without clear user awareness.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill accepts either a local file path or a remote HTTP(S) URL and forwards the content to an external analysis service, but this code provides no explicit consent notice, trust boundary warning, or restriction on what remote resources may be submitted. In a surveillance/fire-detection context, uploaded videos may contain sensitive footage, and URL forwarding can cause unintended disclosure of internal or private camera endpoints to the backend service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The function forwards a local file path or remote URL into analysis logic without clearly disclosing whether content will be uploaded or fetched over the network. In a fire/smoke detection skill, users may submit surveillance footage or sensitive infrastructure imagery, so undisclosed transmission creates privacy and data-handling risk even if the downstream API is legitimate.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2