Back to skill

Security audit

Stranger Proximity Alert Skill | 陌生人靠近预警技能

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent child-safety analysis purpose, but it also uploads sensitive media, silently binds or creates user identity, and persists authentication tokens without enough user-facing control or privacy detail.

Install only if you are comfortable sending uploaded images/videos or provided URLs to the lifeemergence cloud service, having reports tied to an automatically resolved or created identity, and storing local user/token data in the workspace. For use around minors, require clear consent, retention, deletion, and access-control assurances from the publisher before deployment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (19)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to read local files, write local files, invoke shell commands, access environment-derived identity context, and contact cloud APIs, but it declares no permissions or trust boundaries. This creates a capability/manifest mismatch that can cause the agent or reviewer to underestimate what the skill can do, especially because it processes local media and performs cloud queries.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The implementation accepts arbitrary local files and arbitrary remote URLs, then forwards them to a generic analysis backend, which is broader than the declared safety-specific function of warning about strangers near minors. This scope mismatch can cause users or integrators to send unintended content to the service and can enable misuse of the skill as a general-purpose media analysis/upload capability rather than a narrowly scoped child-safety detector.

Description-Behavior Mismatch

Low
Confidence
82% confidence
Finding
The skill exposes report enumeration and export-link generation capabilities that are not necessary for real-time warning of stranger approach. Extra data-access features increase attack surface and may expose historical reports or report image URLs to callers who only expected alerting behavior, creating privacy and data-minimization risks.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The script exposes a generic video analysis and history-listing interface rather than enforcing the narrowly declared purpose of detecting strangers near minors and issuing safety alerts. This scope mismatch is dangerous because users, integrators, or policy controls may trust the manifest description while the implementation can process arbitrary video inputs and enumerate prior analyses, expanding data-processing scope beyond what was advertised.

Intent-Code Divergence

Low
Confidence
90% confidence
Finding
The CLI describes itself as a generic "video analysis tool," which contradicts the manifest’s child-safety stranger-warning purpose and can mislead operators about the real scope of collection and processing. In a sensitive surveillance context involving minors, inaccurate interface documentation increases the risk of unauthorized or overbroad use and weakens informed consent and governance.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file defines generic user-account persistence for usernames, real names, email, birthday, tokens, and default-user selection, which does not align with a skill whose declared purpose is stranger-near-minor warning alerts. Such capability mismatch is dangerous because it suggests hidden collection of user identity/account data beyond what is necessary for child-safety alerting, increasing privacy and abuse risk.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The User model stores identity and authentication-related fields including username, realname, email, token, and open_token without a clear need tied to stranger-warning functionality. In a child-safety context, unnecessary identity/token retention amplifies privacy harm and creates a high-value target if the local database is accessed by other components or compromised.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility layer performs automatic user lookup, silent account creation/login, token acquisition, and token persistence even though the skill is described as stranger-warning analysis for minors. That hidden identity and session-management behavior broadens the skill's privileges and creates undisclosed account activity and backend access unrelated to the stated purpose, which is especially concerning in a child-safety context where users would expect narrow, transparent functionality.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code auto-detects agent workspace roots and creates data/ and skills/ directories programmatically, enabling the skill to discover and modify its execution environment beyond the narrow stranger-warning use case. In an agent ecosystem, this increases the blast radius for persistence, cross-skill interference, and unintended installation or storage behaviors without clear user awareness.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill sends locally supplied images/videos or remote URLs to a cloud API and also retrieves historical reports tied to an internal identity, yet it lacks an explicit privacy, retention, and data-handling disclosure. Because the content concerns minors and facial recognition, the absence of clear notice and controls materially increases the risk of sensitive biometric and child-safety data being transmitted or retained without informed handling expectations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script silently resolves and initializes an internal user identity via OpenIdUtil.resolve_current_open_id without clear user disclosure or explicit consent. In a surveillance-oriented skill involving minors, hidden identity binding can enable covert attribution, logging, or retrieval of user-specific analysis records, creating privacy and accountability risks if users do not understand that identity context is being applied.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads full local file contents into memory and uploads them to the analysis service without any visible user-facing disclosure, confirmation, or consent flow in this file. Because the skill handles video that may contain minors and bystanders, silent transmission creates meaningful privacy and compliance risk if users are unaware that sensitive footage is being sent off-device.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This code reads, sets, and transmits credentials and identity-related headers such as tokens, API keys, Authorization, and user identifiers without any visible user-facing disclosure or consent flow. Even if intended for backend integration, silent handling of credentials and outbound requests creates privacy and trust risks and can expose users to unauthorized data sharing or account actions.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The utility automatically creates local directories and later participates in persistence of user identity state without informing the user. Hidden local state creation is risky because it enables silent retention of identifiers and operational artifacts that outlive a session, contrary to the expected behavior of a simple safety-alert skill.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 支持格式:mp4/avi/mov/jpg/jpeg/png,最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供安全参考,不能替代专业安保措施,紧急情况请及时报警 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
Confidence
71% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "stranger-approach-warning-analysis"
description: "Detects the appearance of strangers near minors and actively issues safety reminder alerts to protect minor safety, suitable for homes, schools, childcare centers, and other scenarios. | 陌生人靠近预警技能,检测未成年人身边出现陌生人员,主动发出安全提醒预警,守护未成年人安全,适用于家庭、学校、托管场所等场景"
version: "1.0.14"
license: "MIT-0"
---
Confidence
82% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2