Back to skill

Security audit

Intelligent Outdoor Care Monitoring & Analysis Tool | 户外看护智能监测分析工具

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches cloud-based outdoor media analysis, but it needs Review because it silently creates or reuses an identity, contacts account services, and persists tokens locally.

Install only if you trust the Life Emergence backend with outdoor images/videos, URLs, account identifiers, and historical monitoring reports. Be aware that the skill can silently create or reuse an identity, perform remote login/registration, and keep tokens in a local workspace SQLite database; use a separate workspace for sensitive media and review/delete local data if needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and instructs use of capabilities including shell execution, local file read/write, network access, and environment use, yet declares no permissions. That mismatch prevents meaningful consent and review, and in this context is amplified because the workflow includes saving uploads locally and invoking backend-connected scripts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The public description frames the skill as simple outdoor target detection, but the documented behavior also includes historical report retrieval, local identity persistence, backend account provisioning/authentication, video handling, and report-link exposure. This is dangerous because users and reviewers may authorize a narrowly described vision skill while it actually performs account and data-management actions with privacy and security implications.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS URLs and forwards them for analysis without allowlisting, scheme hardening beyond prefix checks, or any indication of destination controls. In a skill context, this can enable misuse of backend fetch capability against attacker-chosen URLs, potentially creating SSRF-style exposure or unauthorized processing of remote content.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The implementation materially diverges from the manifest: it performs video analysis and accepts remote video URLs, while the declared skill is for outdoor image monitoring. This kind of capability mismatch is dangerous because operators may grant or invoke the skill under incorrect assumptions, enabling unreviewed processing paths and data flows not covered by the stated purpose.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The code exposes a history/list retrieval function through skill.get_output_analysis_list(open_id=open_id), which is not justified by the manifest's stated purpose of detecting targets in images. Undeclared access to historical analysis data can leak prior user activity or surveillance results and expands the skill's effective privileges beyond what a user would reasonably expect.

Intent-Code Divergence

High
Confidence
91% confidence
Finding
The user-facing CLI and documentation present this as a video-analysis tool, directly contradicting the manifest's image-analysis description. This inconsistency undermines review, consent, and policy enforcement, making it easier for hidden or broader functionality to evade scrutiny in a surveillance-related context.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
This file defines a shared DAO and a User/UserDao that persists and mutates local user-account records, including identity fields and tokens, which is unrelated to the declared outdoor image-monitoring purpose. That capability expansion increases attack surface, creates hidden statefulness, and may allow the skill to retain or correlate user data without clear need or user awareness.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
DAO initialization automatically creates and alters a persistent SQLite schema on startup, introducing hidden write behavior and durable local storage not suggested by the skill's manifest. For an image-analysis skill, this makes the component more dangerous because it silently establishes persistence that can later be used to retain user or operational data across runs.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The model stores user identity information and authentication-related values such as token and open_token in a local SQLite database, which is not justified by an outdoor target-detection skill. This is dangerous because unnecessary credential/token retention expands the blast radius of local compromise and enables tracking, impersonation, or unauthorized reuse if the database is accessed.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The file for an outdoor monitoring skill contains a generic `ai_chat` capability that is unrelated to the declared computer-vision purpose, which expands the skill's effective attack surface and enables hidden secondary behavior. Even though the subprocess call is currently commented out, the presence of this wrapper indicates latent LLM/agent invocation functionality that could later be enabled without aligning with the advertised skill behavior, creating opportunities for prompt injection, data exfiltration, or unauthorized external interactions.

Intent-Code Divergence

Medium
Confidence
80% confidence
Finding
The docstring states that the method invokes an `openclaw agent` via subprocess, but the implementation does not actually perform that action and instead uses a placeholder `result` object. This mismatch is dangerous because it obscures the code's true behavior, hinders auditing, and can conceal or normalize future activation of subprocess-based agent execution in a security-sensitive environment.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This code creates and persists a default user identity for the local workspace, and resolves identity from local files or stored database state even when the user did not explicitly provide one. For an outdoor image-analysis skill, hidden identity provisioning and persistence is scope-expanding behavior that can silently bind the skill to remote accounts and enable unauthorized or undisclosed platform access.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The HTTP utility automatically performs remote registration/login, loads tokens from local storage, and saves refreshed tokens for reuse. This is dangerous because it gives a surveillance-analysis skill undisclosed account-access capability and causes outbound authentication activity unrelated to the stated purpose, increasing the risk of identity misuse, data exfiltration, and unauthorized remote actions.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill derives workspace context from environment variables and filesystem layout, then reads identity material from a workspace data location. In context, this is more dangerous because the declared function is outdoor monitoring analysis, not workspace discovery or credential harvesting, so accessing local identity context is unnecessary and broadens access to potentially sensitive local state.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
When debug mode is enabled, the code turns on low-level HTTP connection debugging and verbose urllib3 logging. Even though later prints try to truncate headers, this mode can still expose request metadata and possibly secrets in logs, which is not justified by the skill's stated image-monitoring role and increases the chance of credential leakage.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The default trigger condition is broad enough that normal discussion of outdoor images or monitoring could activate the skill without clear user intent. In a skill that stores files locally and calls backend services, ambiguous auto-activation increases the chance of unintended data processing or transmission.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The history-query auto-trigger is based on broad everyday phrases, which can cause automatic retrieval of prior monitoring reports without sufficiently scoped intent. Because historical surveillance reports may contain sensitive links and prior analysis data, accidental triggering can expose private information.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states that uploaded image/video attachments are automatically saved as local files, but does not provide an explicit user warning or retention policy. For surveillance media, silent local persistence raises privacy, data leakage, and forensic residue risks if the host environment is shared or compromised.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The workflow mandates direct cloud API access for historical reports and forbids local alternatives, but gives no user-facing privacy warning about remote retrieval, identifiers, or backend correlation. In the surveillance context, historical report access may reveal sensitive monitoring records and links, making undisclosed cloud queries materially risky.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id without clear user-facing disclosure, and it does so even before validating whether the requested operation actually needs identity context. Hidden identity binding can enable unintended attribution, privacy violations, or access to another user's historical analysis data if the identity source is environment-derived or implicitly reused. In a surveillance-oriented skill that processes monitoring data and supports listing prior analyses, undisclosed identity resolution is more sensitive because it can expose or associate potentially private monitoring results with a user account without explicit consent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code reads an identity value from data/smyx-api-key.txt without any visible user notification, consent, or purpose limitation. Silent consumption of local identity material is risky because it can repurpose existing workspace credentials for remote access without the operator understanding that the image-analysis skill is doing so.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The utility sends identity data such as openId/mobile/source to a remote login endpoint automatically. This is dangerous because users of an outdoor monitoring skill would not reasonably expect silent transmission of identity attributes to unrelated platform services, creating privacy and consent issues and potentially enabling account linkage or abuse.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
93% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2