Stranger Recognition Skill | 陌生人识别技能

• Outcome: Review
• Latest audit: Oct 27, 2026 · 2:16 AM UTC
• Version: 1.0.17

Overview

This cloud facial-recognition skill needs review because its no-analysis option is ignored and its credential handling lacks destination restrictions.

Before using private footage, request fixes for the ignored no-analysis option and unrestricted credential forwarding. Confirm the service's retention and deletion policies, and use separate workspaces or accounts for different users. Face enrollment adds people to a cloud reference database shared under the selected identity.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (25)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The main recognition workflow matches the description. However, explicit enrollment of new people into the reference database is an additional state-changing capability, not merely an implementation detail of comparing faces. The code exposes this operation and forwards its parameters, although the actual database write is delegated to imported service code. History retrieval and report output are supporting features rather than separate material mismatches.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The reported attachment of API keys and authentication tokens to caller-supplied absolute URLs creates a credential-exfiltration path if an attacker can influence the destination. Silent account initialization and persistent identity reuse increase the sensitivity of those credentials, although the referenced scripts are not provided here and the reported implementation cannot be independently verified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The supplied code exposes video-analysis and history-listing operations rather than an identifiable stranger-recognition workflow. It contains no visible face matching, known-person reference management, image-detection workflow, or surveillance alert logic. Its analysis implementation is delegated to skill.get_output_analysis, whose internals are not supplied, so facial recognition cannot be ruled out downstream. Nevertheless, the visible behavior does not substantiate the declared specialized purpose and includes an undisclosed history-retrieval capability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The supplied chunk does not substantiate the declared recognition capability; its visible behavior is generic scaffolding and an unfinished chat helper. It does not actually launch an external agent, since subprocess execution is disabled. Imported base classes and services could provide additional functionality, but their implementations are not supplied, so this assessment is limited to the visible code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence

Finding

Generic AI-analysis configuration could support the declared skill, so those endpoints alone do not establish a mismatch. However, the explicit health-order report export resource is outside the stated purpose. This assessment is limited to configuration: the chunk defines the URL but does not demonstrate a network request or actual report export. The absence of recognition logic in a configuration file is not itself evidence of a mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "stranger-recognition-analysis"
description: "Identifies strangers appearing in surveillance areas through facial comparison; supports video stream and image detection, suitable for stranger warnings in residential communities, units, access control, and other scenarios. | 陌生人识别技能，通过人脸比对识别监控区域出现的陌生人员，支持视频流和图片检测，适用于小区、单位、门禁等场景的陌生人预警"
version: "1.0.21"
license: "MIT-0"
---

# 🕵️ Stranger Recognition Skill | 陌生人识别技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · �

The recognition workflow lacks a clear privacy warning about sending surveillance media and facial data to the remote analysis service.

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

The workflow directs remote processing of surveillance media and facial information without a clear pre-transfer privacy notice or consent checkpoint. Although cloud storage and API processing are mentioned elsewhere, sensitive biometric data can still leave the user's environment without an informed decision about the recipient, retention, or shared reference database.

Content

No source excerpt is available for this finding.

The HTTP helper can forward service credentials to arbitrary absolute URLs.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The helper accepts arbitrary absolute HTTP or HTTPS URLs and then automatically attaches service tokens and the API key without checking the destination. If an attacker influences a caller's URL, credentials can be sent to an attacker-controlled host; HTTP destinations also expose them in transit, potentially compromising access to sensitive surveillance data.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The --export-env-only option promises not to execute analysis, but analysis still runs.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only flag is parsed but never checked, so supplying otherwise valid arguments still invokes skill.get_output_analysis despite the explicit promise not to execute analysis. In this biometric-surveillance context, this can unintentionally submit sensitive media for processing or request face enrollment when --enroll yes is supplied, although the downstream implementation determines the actual side effects.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = result_json_common_ai_response

        result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_health_ai_response:
            result_json = result_json_health_ai_response

Local video contents are submitted to the analysis API without disclosure that the file will be uploaded.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The local-file path reads the entire supplied file and passes its contents to the analysis API without an upload notice or consent check in the shown code. Surveillance imagery can contain sensitive biometric and bystander information, making undisclosed transfer a meaningful privacy risk; however, the API implementation, destination, and any disclosures elsewhere are not provided, so malicious exfiltration is not established.

Content

No source excerpt is available for this finding.

The documented non-analysis mode still executes video analysis.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The --export-env-only option promises to output environment-setting commands without performing analysis, but args.export_env_only is never checked. When supplied with a valid --input or --url, execution still reaches skill.get_output_analysis(), potentially processing or transmitting sensitive surveillance footage despite the user's explicit non-analysis selection. The facial-recognition context increases the privacy impact, although the downstream implementation and actual data transmission are not shown.

Content

No source excerpt is available for this finding.

FileUtil.open silently opens files in write mode, truncating existing contents.

Medium

• Category: Output Handling
• Confidence: 97% confidence

Finding

At L101, opening a path with mode 'w' immediately truncates an existing file. The generic open helper has no comment, docstring, confirmation, or user-facing log disclosing this destructive behavior; exception tracing does not disclose a successful overwrite.

Content

No source excerpt is available for this finding.

The request helper silently registers a remote service account and persists its credentials, beyond the advertised stranger-recognition behavior.

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

An ordinary request can trigger silent remote account registration, transmit the current identity, and persist returned authentication tokens without an explicit provisioning step in this helper. Backend authentication is plausible for a recognition service, but coupling it implicitly to requests creates an undisclosed privacy and account-lifecycle side effect; the security of persisted tokens cannot be determined from this file.

Content

No source excerpt is available for this finding.

HTTP requests can silently initiate remote user registration without disclosure.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The authentication fallback explicitly submits 'silent': 1 and 'register': 1, so making a request can create a remote account and disclose an identity without a separate registration decision in this code. This is the same implicit-provisioning issue as SDI-1, not an additional independent vulnerability.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 561)May include surrounding context.

python

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

Configuration loading silently creates directories and YAML files, including during module import.

Low

• Category: Output Handling
• Confidence: 94% confidence

Finding

When a configuration file is absent, YamlUtil.load creates its parent directories and writes a new file without any log, confirmation, or explanatory comment or docstring. BaseEnum.init_subclass invokes this loader at L053 and L058, so merely importing the module can modify the filesystem—an unexpected side effect for configuration loading.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 243)May include surrounding context.

python

username = getattr(model, "username", None)
            if username:
                column_names = self.__model__.__table__.columns.keys()
                update_data = {key: getattr(model, key) for key in column_names if key != "username"}
                return self.update_by_username(username, **update_data)

            return None

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 353)May include surrounding context.

python

column_names = self.__model__.__table__.columns.keys()

            for key in column_names:
                value = getattr(model, key)
                setattr(instance, key, value)

            session.commit()

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 326)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/dao.py (reported line 441)May include surrounding context.

python

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

ai_chat documents an agent invocation but performs no invocation and returns no analysis.

Low

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The docstring at L26 states that this method invokes the openclaw agent through subprocess, and L33-L34 promise an analysis result or session ID. However, command execution is commented out at L61-L66, and the empty dictionary assigned at L68 raises AttributeError when accessed as result.stderr at L70. The exception is caught at L81-L82, so the method returns None without performing the documented analysis.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · skills/smyx_common/scripts/util.py (reported line 30)May include surrounding context.

python

elif isinstance(cur, dict):
                        cur = cur.get(part, default)
                    else:
                        cur = getattr(cur, part)
                return cur
            except Exception:
                return default

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2