Back to skill

Security audit

Office Prolonged Sitting & Posture Warning | 成人久坐/姿态预警(办公室)

Security checks across malware telemetry and agentic risk

Overview

This posture-analysis skill is mostly coherent, but it needs Review because it processes sensitive workplace video through cloud services while silently creating and persisting user identity tokens.

Install only if you are comfortable with office video and report history being handled by the provider's cloud API. For workplace use, require employee notice/consent, define who may access historical reports and export links, review retention and deletion practices, and avoid using this skill with sensitive recordings unless the identity/token storage and backend endpoints are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises only posture-analysis functionality, but the manifest/documentation indicates capabilities including shell execution, file read/write, network access, and environment use without declaring permissions. This creates an under-disclosed trust boundary: users and platforms may authorize a seemingly simple vision skill while it can invoke scripts, access local state, and communicate with remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose is local real-time posture monitoring, but the behavior expands into remote API submission, polling, identity/token management, local user persistence, and report retrieval. This mismatch is dangerous because it hides sensitive data flows and identity handling behind a benign health-monitoring description, increasing the risk of covert collection, tracking, and exfiltration of employee video metadata and user records.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The manifest frames the skill as real-time posture analysis and alerting, but the documentation adds cloud historical-report querying and report-link retrieval. That scope expansion introduces extra data access paths and backend exposure not obvious from the top-level description, which is especially sensitive for workplace surveillance data.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Automatic creation and reuse of a local default user identity is unrelated to simple posture warning analysis and enables persistent tracking across sessions. In an office-monitoring context, this raises privacy and accountability risks because employee analyses and history can be silently linked to locally maintained identities without explicit disclosure or user control.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS video URLs even though its declared purpose is analysis from a fixed office camera pointed at a workstation. This scope expansion allows the caller to cause analysis of any remotely hosted video, which can bypass expected deployment constraints and increase privacy, compliance, and data provenance risks.

Description-Behavior Mismatch

Low
Confidence
76% confidence
Finding
The skill exposes generic report listing and export-link generation functionality that is broader than the posture-warning behavior described in the manifest. Even without explicit auth logic shown here, this increases the attack surface and may expose historical analysis artifacts or metadata in ways users and reviewers would not expect from the declared skill scope.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This file exposes broad generic HTTP capabilities including add, edit, delete, and arbitrary GET/POST/PUT/DELETE wrappers that are not constrained to the stated posture-analysis purpose. In a skill that should primarily analyze posture video and emit reminders, this unnecessarily expands the attack surface and can enable the skill or downstream callers to interact with unrelated remote resources or management APIs.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The code supports general-purpose remote resource management behavior rather than a tightly scoped posture-warning workflow, including generic paging and transport helpers usable for many unrelated backend actions. In the context of a camera-based worker-monitoring skill, this mismatch is concerning because it permits functionality beyond the declared business need and increases the chance of abuse, hidden data flows, or unauthorized backend interaction.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill is for office-worker posture monitoring, but this module persists user-account records in a shared local database, including identity-linked profile data that is not clearly required for the stated function. In a camera-based workplace monitoring context, unnecessary identity storage expands privacy risk, increases consequences of local compromise, and suggests excessive data collection beyond the declared purpose.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The User model stores authentication tokens, open tokens, email, birthday, age, and real names in an unprotected local SQLite database, yet the skill description is limited to posture analysis from a fixed camera. Collecting and retaining tokens and personal profile data without clear relevance creates a serious privacy and credential-exposure risk if the host or workspace data directory is accessed by other components, users, or malware.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This shared utility performs remote account creation/login, token acquisition, and persistence of credentials despite the advertised skill being a local posture-analysis tool. That is a serious scope mismatch: using the skill can silently establish or reuse identities and communicate with external services, creating privacy, consent, and supply-chain risk unrelated to posture monitoring.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code reads workspace identity material from data/smyx-api-key.txt and auto-creates persistent default users when no identity is present. For a posture-warning skill using a fixed office camera, this is unjustified capability expansion that can bind local workspace state to remote identity and create long-lived tracking identifiers without clear user awareness.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The workspace and agent-environment detection logic scans execution context and locates workspace roots, data directories, and skills directories far beyond what is needed for posture analysis. While not directly exploitive on its own, it broadens the skill's awareness of the host environment and facilitates later file access, persistence, or cross-agent interference.

Vague Triggers

Medium
Confidence
83% confidence
Finding
A default trigger that activates on broadly described office-video analysis requests can cause the skill to run in situations the user did not specifically intend. Because the skill sends data to scripts/backends and may persist identity/history, over-broad invocation increases the chance of unauthorized processing of sensitive workplace video.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The keyword trigger list includes broad health and office terms that can match benign or unrelated requests, causing unintended activation. In this context, accidental activation matters because the input is sensitive employee video and the skill supports cloud reporting/history behavior.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The API documentation describes continuous camera-based monitoring of workers' posture and sedentary behavior, along with historical record querying and full report export, but provides no privacy, consent, retention, access control, or employee-notice safeguards. In a workplace surveillance context, omission of these controls materially increases the risk of misuse, over-collection, unauthorized disclosure, and noncompliance with privacy and labor requirements.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
This tool explicitly analyzes local or remote office surveillance video, which is highly privacy-sensitive biometric/behavioral data, yet the CLI presents no consent, notice, or data-handling warning. In an office context, silent analysis of workers increases the risk of non-consensual monitoring, policy violations, and improper processing of sensitive personal data.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
When given a local path, the code reads the file contents and submits them for analysis without any disclosure, confirmation, or visible indication in this file that data will leave the local environment. Because the skill processes workplace video, this can transmit sensitive employee imagery and office information to a backend unexpectedly, creating privacy and compliance exposure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
When debug mode is enabled, HTTPConnection and urllib3 debug logging are turned on globally, which can expose URLs, headers, bodies, and tokens in logs. For a skill that may process workplace-related data and remote authentication tokens, such verbose logging materially increases risk of credential leakage and sensitive data exposure.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code reads an internal identity value from a workspace file without clear disclosure or necessity for a posture-warning skill. This can silently ingest sensitive local identity material and then feed it into later authentication/network flows, increasing privacy and misuse risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Automatic user creation sends identity fields such as openId/mobile to an external service without clear user-facing disclosure. In the context of an office posture-analysis skill, this hidden transmission is unjustified and can expose employee-related identifiers or create remote accounts unexpectedly.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The generic HTTP wrapper automatically attaches app IDs, usernames, tokens, and platform metadata to outbound requests and can retry authorization flows. This creates broad, silent exfiltration capability and persistent credential handling unrelated to local posture detection, making the skill substantially more dangerous than its stated purpose suggests.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
This call transmits registration/login data to an external endpoint. External transmission is especially concerning here because the advertised functionality is real-time local posture warning, so sending identity-related data off-host is outside reasonable user expectation and creates privacy and account-abuse risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2