Back to skill

Security audit

Real-time Employee Absence Monitoring Skill | 人员离岗实时监测技能

Security checks across malware telemetry and agentic risk

Overview

The skill matches its advertised cloud staff-absence analysis purpose, but it also silently creates or reuses an identity, stores tokens locally, and uploads sensitive workplace media to an external service with limited user control.

Review this skill before installing. Use it only if you are comfortable sending workplace images or videos and identity-linked report data to the configured Life Emergence cloud services, and only where personnel monitoring is authorized. Ask the publisher for clear retention, deletion, endpoint allowlist, and token-storage details, especially because the skill can silently create/reuse a local identity and keep authentication tokens in a workspace SQLite database.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill manifest exposes operational capabilities such as shell execution, network access, file read/write, and environment use, but does not declare permissions or present user-visible constraints. This creates a mismatch between what the skill can do and what a reviewer or runtime policy may expect, increasing the chance of unintended command execution, data exfiltration, or filesystem modification.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script contains hidden identity-related behavior unrelated to the advertised purpose of staff absence analysis: it resolves a current internal user identity and supports listing user-specific analysis history via a hidden --open-id parameter and --list mode. In this context, that creates an unnecessary access path to identity-scoped data and increases the risk of unauthorized history access or privacy leakage if OpenIdUtil or downstream APIs do not strictly enforce authorization.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill accepts arbitrary http/https URLs and forwards them to the backend analysis service without restricting origin, scope, or use case. That expands the capability from local staff-absence monitoring into general remote video ingestion, which can be misused for surveillance of unintended targets or to access internal/backend-fetch paths depending on how the downstream service handles URLs.

Description-Behavior Mismatch

Medium
Confidence
78% confidence
Finding
The skill exposes report export links and supports report-history access beyond the narrowly described real-time absence-detection function. If access control is weak elsewhere, these features can disclose prior analysis artifacts and metadata, increasing privacy and data-exposure risk for monitored personnel.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file exposes generic HTTP and CRUD wrapper methods that can call arbitrary URLs and perform add/edit/delete operations, which materially exceeds the narrowly described staff-absence detection purpose. In an agent skill context, overly broad network and mutation capabilities increase the attack surface for unintended data access, proxying requests to internal services, or misuse of the skill as a general-purpose API client.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The get_user_by_username capability introduces user-account lookup functionality that is not justified by the stated computer-vision absence-detection use case. Even if intended for convenience, this can expose identity data or facilitate account enumeration when embedded in a skill that otherwise should not need directory-style user queries.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file defines a generic user-account persistence model, including identity and token-related fields, which exceeds the stated absence-detection purpose of the skill. This kind of scope creep increases the attack surface and raises risk of unnecessary collection and retention of sensitive user data unrelated to the manifest-declared function.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The model persists token and open_token values in plaintext-like string columns without any visible protection or purpose justification. If the local SQLite database is read by another component, user, or compromised process, these credentials could enable account takeover, API abuse, or lateral movement.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The implementation does not match the declared skill purpose at all; instead of personnel absence detection logic, it provides generic AI-agent chat scaffolding. This kind of capability mismatch is dangerous because it can conceal unintended or unauthorized agent functionality inside a skill that operators may trust for a narrow computer-vision use case, expanding the attack surface and enabling misuse of prompts or external model access.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility performs remote account provisioning and login/token acquisition flows that are unrelated to the declared staff absence detection purpose. It silently creates or reuses identities and retrieves tokens, expanding the skill from vision monitoring into undisclosed identity management and external service access; in context, that mismatch is highly suspicious and increases risk of covert account use and data exfiltration.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code reads and writes workspace files and persists identity-related state in local storage/database beyond what is needed for a computer-vision absence detection skill. This creates hidden state, enables silent user tracking or identity reuse across runs, and broadens the attack surface without a clear functional justification from the manifest.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill inspects workspace paths, agent layout, and environment variables to determine installation and storage context. While this may support multi-agent operation, it is not justified by the manifest's monitoring purpose and gives the code awareness of broader agent/workspace structure, which can facilitate unauthorized persistence, data access, or placement of artifacts in unexpected locations.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The default trigger condition activates whenever a user provides a video/image URL or file for personnel absence monitoring, which is broad enough to capture generic media-analysis requests. Overbroad activation can cause the wrong skill to run automatically, leading to unexpected file handling, cloud submission, or analysis of sensitive surveillance content without clear user intent.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The history-report trigger keywords are ambiguous and overlap with common phrases such as viewing reports or report lists. This can silently invoke cloud history lookup when the user meant a general reporting request, potentially exposing prior surveillance records linked to an internal identity context.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that uploaded attachments or media files will be automatically saved locally, but does not warn the user that a file write will occur or define where data will be stored. Silent local persistence can create privacy, retention, and tampering risks, especially for surveillance images and videos that may contain sensitive personal information.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill requires direct cloud API queries for history reports and indicates network-based media processing, but does not provide privacy, integrity, or trust-boundary warnings. Because the content involves personnel monitoring data, undisclosed cloud transmission or retrieval can expose sensitive surveillance records and create compliance and confidentiality issues.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation states that user media and an `open_id` are sent to a cloud API for analysis, but it does not warn about data transmission, retention, third-party processing, or consent requirements. In a personnel absence monitoring context, the uploaded videos/images can contain identifiable worker data and behavioral information, so omission of privacy guidance can lead to unauthorized collection, noncompliant processing, or accidental exposure of sensitive operational footage.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The code reads the entire local file and uploads it to the analysis service without any visible consent, warning, or disclosure in this component. Because the skill processes videos of people in workplaces, silent transmission of potentially sensitive footage creates privacy, compliance, and data-handling risks.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The script accepts a hidden API key parameter and supports remote URL/video analysis without clearly warning users that media and credentials may be transmitted to a remote backend. In a surveillance/personnel-monitoring context, this increases the sensitivity because videos may contain employees, workplace layouts, and operational activity, creating confidentiality and privacy exposure if users are unaware of off-host processing.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The utility exposes file write and directory creation helpers with no user-facing disclosure or consent flow. In isolation these are common helpers, but in this skill context they support silent local persistence that is unrelated to the stated real-time monitoring purpose, making undisclosed state changes more concerning.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads an identity value from workspace storage (data/smyx-api-key.txt) without clear disclosure or user action. Silent consumption of locally stored identity material can cause unintended account linkage, cross-skill identity reuse, or transmission of sensitive identifiers to remote services.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The utility silently generates and persists a default user identity in a local database when none is supplied. This creates durable identity state without user awareness, enabling hidden account correlation and subsequent authenticated network activity under an automatically created principal.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
HTTP requests attach and transmit usernames, tenant/platform metadata, API keys, access tokens, and authorization tokens without clear user disclosure. Combined with the skill's unrelated purpose, this creates a significant risk of covert identity transmission and unauthorized use of persisted credentials against external services.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2