Security audit

Video Search test

Security checks for vulnerabilities and agentic risk

Overview

The skill’s video-search purpose is real, but it also silently uses identity data, stores reusable tokens, and steers users toward a payment skill in ways that need review.

Review this skill before installing. It sends videos or URLs to a vendor cloud service, can query cloud history tied to an internal identity, may silently register or reuse an account, and stores service tokens in a local workspace database. Do not let an agent follow payment-skill installation or recharge instructions returned by this skill without separate human confirmation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: skills/smyx_common/scripts/util.py:654
Finding: Remote API response triggers payment-skill installation steering
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: skills/smyx_common/scripts/util.py:546
Finding: Upstream platform identity is silently disclosed to an external authentication service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:578
Finding: Reusable authentication tokens are stored in an unencrypted workspace SQLite database
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (51)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Authenticated API wrappers, identity resolution and persistence, auto-registration/login, and workspace discovery are much more privileged than the declared purpose. In this skill context, those hidden capabilities are particularly dangerous because the skill also accepts local files and URLs, making it a conduit for sensitive media plus account-scoped backend operations.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "video-search-analysis" description: "Conducts intelligent video search based on target and semantic descriptions; supports conventional target retrieval, natural language description retrieval, and vectorized model matching. | 视频搜索/视频检索智能分析技能，基于目标、语义描述进行智能视频搜索，支持常规目标检索、自然语言描述检索、向量化模型匹配" version: "1.0.5" license: "MIT-0" --- # 🔎 Intelligent Video Search & Retrieval Analysis Skill | 视频搜索检索智能分析技能 > **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code reads a workspace identity file (data/smyx-api-key.txt), falls back to local database identities, and creates persistent default user identifiers when none are supplied. This is unrelated to video retrieval and dangerous because it silently accesses and mutates local identity state, enabling covert account reuse and making credential exposure or cross-skill identity confusion more likely.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The utility code provisions users through a remote phoneLogin endpoint, caches tokens, and persists identity state locally, which is outside the declared video-search purpose. In an agent-skill context, this creates hidden authentication side effects and allows the skill to establish and reuse identities/tokens without clear user consent, increasing the blast radius if the skill or workspace is compromised.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and directs use of shell execution, network access, local file handling, and environment-backed identity logic, but does not declare any explicit tool scope or permission boundaries. In an agent setting, missing capability constraints increases the blast radius of prompt misuse, unintended command execution, and silent access to local or remote resources.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default trigger says the skill should automatically activate whenever a user needs to search video for specific content, which is broad and easy to match accidentally. Overbroad auto-invocation is dangerous because it can cause unintended processing of user-provided media, network resources, or historical records without sufficiently clear consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The history-report trigger relies on broad natural-language keywords like 'history report' and 'report list,' which can easily be mentioned incidentally. In an account-scoped skill with hidden identity resolution, ambiguous history triggers increase the risk of unintentionally listing sensitive prior analysis records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill states that uploaded attachments or media files are automatically saved locally, but does not present this as a clear user-facing warning with retention and handling details. Automatic local persistence of potentially sensitive video content increases privacy and data exposure risk, especially on shared runners or systems with other skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) even though the --open-id argument is hidden from help output. This can cause the tool to access or bind to user identity information without clear user awareness or consent, which is a privacy and authorization risk, especially because the resolved identity is later used to fetch analysis lists.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.
python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.
python
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill returns fixed Chinese-language messages such as 分析报告结构化结果 and 获取报告导出图片链接, and similar hard-coded Chinese strings appear elsewhere in the file. There is no visible option for users to choose their preferred language or locale, which violates the requirement not to force a specific language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code reads an arbitrary local file from disk and uploads its full contents to a remote analysis service via self.analysis(...), but there is no user-facing disclosure, confirmation, or consent flow in this code path. In an agent/skill context, that is a real privacy and data-exfiltration risk because users may provide sensitive local videos without understanding they are being transmitted off-host.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2