Stranger Recognition Skill | 陌生人识别技能

• Outcome: Review
• Latest audit: Aug 26, 2026 · 7:02 PM UTC
• Version: 1.0.12

Overview

The skill matches its face-recognition purpose, but it quietly creates/uses local identity state and sends sensitive media and identifiers to under-disclosed remote services.

Install only after verifying the configured backend endpoints, who operates them, what happens to uploaded surveillance media and face data, and how local identity files, SQLite records, and tokens can be deleted. Require explicit consent for biometric enrollment and history lookup, and avoid using this with private camera footage unless the retention and account-linking behavior is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 83% confidence
• Finding: Using getattr(self.__model__, key) on caller-supplied filter keys allows untrusted input to select arbitrary model attributes for query construction. While this is not SQL injection because SQLAlchemy parameterizes values, it can enable unauthorized querying on sensitive columns, trigger errors/DoS via invalid attributes, and bypass intended field-level restrictions if higher layers pass user-controlled filters directly.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 82% confidence
• Finding: The count() method has the same pattern of dynamic model attribute lookup using untrusted filter keys. In a surveillance/stranger-recognition skill, database metadata such as user existence and record counts can be sensitive, so unrestricted filtering can leak information or facilitate enumeration if exposed through an API layer.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and instructs use of shell execution, network access, and local file read/write, but declares no permissions boundary. This creates a transparency and governance gap: an agent may invoke powerful capabilities without an explicit consent or sandboxing model, increasing the risk of unintended data exposure or overbroad execution.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is presented primarily as stranger recognition and warning, but it also supports enrolling new identities into the facial database. That is a materially different capability involving biometric database modification, which can surprise users and enable unauthorized persistence of sensitive personal data if triggered improperly.

Description-Behavior Mismatch

Low

• Confidence: 74% confidence
• Finding: The documentation expands the skill from recognition/reporting into automatic cloud history querying, which is a distinct data-access behavior. This mismatch can cause users or orchestrators to underestimate that the skill may retrieve prior records from a remote service tied to an internal identity.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file documents pet health analysis APIs while the skill is ներկայացված as a stranger-recognition/facial comparison capability. This kind of domain mismatch is a strong indicator of mispackaging, supply-chain confusion, or deceptive content that could cause an agent or operator to call unrelated endpoints, expose sensitive data to the wrong backend, or approve a skill under false pretenses. In a surveillance/face-recognition context, undocumented cross-domain behavior is especially risky because it may redirect biometric workflows to an unintended service.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The code accepts arbitrary local file paths and arbitrary remote HTTP/HTTPS URLs, then forwards the content or URL to a backend analysis service with only extension and size checks. In a surveillance/face-recognition context, this broad input surface can enable unintended data exfiltration of local media and use of the backend to fetch untrusted remote resources outside the stated stranger-recognition scope.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file exposes broad generic network capabilities including add/edit/delete and arbitrary http_get/http_post/http_put/http_delete wrappers that are not constrained to the stated stranger-recognition use case. In an agent skill context, unnecessary general-purpose HTTP primitives expand the attack surface and can be repurposed to access unrelated internal APIs, modify remote state, or exfiltrate data if other parts of the skill can influence the URL or payload.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The get_user_by_username capability introduces user-account lookup functionality that is unrelated to facial stranger detection and may enable enumeration of valid accounts or collection of identity data. In a surveillance-oriented skill, this extra identity-access feature increases privacy and abuse risk because it can correlate recognition workflows with user records beyond the declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code inspects environment-derived workspace context and later uses that context to locate data directories and identity files unrelated to the advertised stranger-recognition function. This expands the skill's access to local agent state and creates hidden coupling to workspace/user identity, which is dangerous because surveillance-oriented skills already handle sensitive data and should minimize unrelated local state access.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code can silently register or log in a user against an external health endpoint using locally resolved identity values. That behavior exceeds the stated purpose of face-based stranger recognition and creates an undisclosed account bootstrap/data transmission path, potentially linking local users or agents to external services without informed consent.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The auto-trigger rules for history queries include broad natural-language phrases that may match ordinary conversation and cause unintended retrieval of historical reports. In a surveillance/biometric context, accidental disclosure of prior detections or report metadata raises privacy and data minimization concerns.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that uploaded media is automatically saved locally, but does not provide a prominent user-facing warning, retention policy, or storage location disclosure. For surveillance imagery and facial data, silent local persistence increases risk of unauthorized access, over-retention, and compliance violations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill mandates direct cloud API queries for historical reports without a clear privacy warning about remote processing and data transfer. Because the content involves facial recognition reports and identity-linked history, undisclosed cloud access can expose sensitive surveillance data to remote services unexpectedly.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: When `--enroll yes` is used, the tool transmits biometric enrollment data along with `person_name` and optionally `person_id`, but the CLI does not present an explicit privacy warning, consent prompt, or data-handling disclosure before sending that sensitive information. In a facial-recognition context, silent collection or transmission of biometric identifiers materially increases privacy and compliance risk, especially if used by non-expert operators.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill reads local file contents and uploads them to the analysis API without any user-facing notice, consent flow, or in-code disclosure at the point of transfer. In a facial-recognition/surveillance context, this is especially sensitive because the files may contain biometric data or other private footage, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The script accepts a hidden --api-key argument suppressed from help output, enabling credential use without transparent user disclosure or clear auditability. In a surveillance/facial-recognition context, concealed credential pathways increase the risk of unauthorized backend access, misuse of privileged APIs, and reduced operator awareness of sensitive authentication handling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Using OPENCLAW_WORKSPACE and script-path inference to derive workspace roots is sensitive because it reveals and operationalizes environment-specific filesystem context without disclosure. In an agent skill, this can enable unexpected access to local data areas and makes downstream file reads/writes harder for users to reason about.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The utility creates a data directory in the inferred workspace automatically and without user-facing notice. Silent persistence is risky because it establishes durable local state for a surveillance-related skill, potentially storing identity or operational data without transparent consent or operator awareness.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Automatically creating a skills directory modifies the agent workspace without disclosure. While not directly exploitable by itself, it enables hidden state changes and installation side effects beyond the narrow function of stranger detection, which is especially concerning in sensitive surveillance deployments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code reads data/smyx-api-key.txt and treats its contents as an internal identity value without clear disclosure. Accessing a credential-like local file in a skill whose stated purpose is facial stranger recognition is a scope mismatch and could expose or repurpose local secrets or identifiers for unrelated remote operations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This code creates and persists a default local user identity when none is provided, without user-facing warning. Hidden identity generation and durable storage can mask attribution, create silent tracking state, and serve as a precursor for later external authentication or data transmission.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The function sends identity data including openId/mobile/source to an external login/registration endpoint without clear disclosure. This is dangerous because it silently transmits user-linked information off-host and can create or bind external accounts, which is far outside the expected behavior of a stranger-recognition skill handling surveillance contexts.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The general HTTP helper automatically attaches tokens, API keys, and user identifiers, then transmits them to remote endpoints. In a shared utility used by a surveillance skill, this creates a broad and opaque exfiltration surface for credentials and user context, especially since URL normalization allows relative endpoints to be sent to a configured external base URL.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: This outbound POST transmits identity-bearing data to an external service. External transmission is especially sensitive here because the skill advertises stranger recognition, not remote account management, so the network behavior is unexpected and could leak operator or tenant-linked identifiers.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2