Back to skill

Security audit

Large Model Visual Question Answering Skill | 大模型视觉问答技能

Security checks across malware telemetry and agentic risk

Overview

This skill performs cloud visual analysis, but it also silently creates or reuses an account identity, stores tokens locally, and can query cloud history with broad automatic triggers.

Install only if you are comfortable with selected images/videos and questions being sent to the configured cloud service, with the skill creating or reusing a local account identity, storing tokens in a workspace SQLite database, and retrieving cloud history/report links automatically when history-related phrases are used. Review or change the dev/private service configuration before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (32)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares no permissions, yet its documentation clearly instructs use of filesystem access, shell execution, environment use, and network calls. This under-declaration can mislead reviewers and users about the actual trust boundary, causing execution of a much more privileged workflow than expected.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is visual Q&A, but the behavior expands into identity creation/reuse, token handling, local database access, remote login provisioning, and historical record retrieval. This mismatch hides materially different security and privacy behaviors, increasing the chance that users invoke account-linked actions without informed consent.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The documentation broadens a simple visual-Q&A skill into a cloud-backed report platform with historical lookup and report-link output. That scope expansion changes the data sensitivity and user expectations, especially if prior analyses are linked to an internal identity and exposed through automatic retrieval.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill makes cloud history lookup a mandatory behavior triggered by conversational phrases, even though the core purpose is image question answering. This creates hidden secondary actions that may access remote user-linked data outside the user's primary intent.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Automatic reuse or creation of internal user identity is unrelated to the minimum function needed for image Q&A and introduces account binding, persistence, and potential cross-session data linkage. Because the identity is handled silently, users may not realize reports and tokens are being associated with a local or remote profile.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The documented API endpoints and scenario code describe pet health analysis rather than the declared visual Q&A capability, which is a significant integrity mismatch between the manifest and the referenced behavior. This can mislead reviewers, users, or orchestration systems into invoking sensitive health-related backend functionality under an unrelated skill identity, increasing the risk of unauthorized data handling or privilege misuse.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The script exposes a hidden capability to retrieve a user's prior visual QA analysis list, which is unrelated to the manifest's stated purpose of answering questions about image content. Undocumented access to historical analysis data increases the risk of privacy leakage, especially if prior prompts, images, or metadata are sensitive and users are unaware this retrieval path exists.

Context-Inappropriate Capability

Low
Confidence
80% confidence
Finding
Resolving an internal user identity in a skill described only as visual question answering introduces hidden identity handling beyond the declared feature set. Even if used for backend scoping, collecting or deriving identity without clear disclosure expands the privacy surface and can enable unexpected correlation of user activity.

Description-Behavior Mismatch

High
Confidence
88% confidence
Finding
The implementation accepts remote URLs and local files as video analysis inputs, which materially exceeds the declared image-only visual Q&A capability in the skill metadata. This kind of scope mismatch is dangerous because users and calling systems may grant trust or permissions based on the manifest, while the code actually enables broader external-content processing and data transfer.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill exposes report-listing and export-link generation features that go beyond simple open-ended visual Q&A. Hidden secondary capabilities increase risk because they may reveal prior analysis records or artifact URLs to callers who expected only transient question-answering behavior, potentially exposing sensitive outputs or metadata.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The implementation materially diverges from the declared skill purpose: it performs video analysis, accepts local files and arbitrary remote video URLs, and exposes history listing behavior that is not described in the manifest. This kind of capability mismatch is dangerous because users, reviewers, or policy gates may authorize the skill for image Q&A while the code can access and process broader media and metadata than expected, enabling hidden data access or network-enabled behavior under a misleading description.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The code accepts arbitrary network video URLs via --url even though the skill description only promises image-based visual Q&A. Undisclosed remote-fetch capability expands the trust boundary and can be abused to retrieve attacker-controlled content or trigger internal/network access paths through the backend analysis service, making the skill more dangerous than users and reviewers would reasonably expect.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This module initializes and mutates a persistent local SQLite database even though the stated skill purpose is image question answering. In a least-privilege agent setting, unrelated stateful storage increases attack surface, enables unnecessary retention of user data, and creates covert persistence capability that is contextually suspicious for a VQA skill.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The file defines a full user model containing identity fields and tokens, plus DAO support to retrieve default users. For an image VQA skill, maintaining user records and authentication-like token fields is unjustified and materially increases privacy and credential-handling risk if the component is invoked or reused elsewhere.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The generic DAO exposes create, update, modify, delete, and bulk query capabilities that are not necessary for open-ended image QA. In this context, destructive and state-mutating operations increase the blast radius of misuse, making unauthorized data tampering or persistence possible if other parts of the agent can reach these methods.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The utility initializes and persists user identities unrelated to the stated visual Q&A purpose, including reading local identity state, creating default users, and updating global current-user values. In a VQA skill, this broader account lifecycle behavior expands the trust boundary and can cause silent identity creation, persistence, and reuse without meaningful user awareness.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The HTTP helper does much more than send requests for image QA: it performs silent login/registration, token bootstrapping, persistent user lookup/storage, and payment/upsell handling. This hidden expansion of function can exfiltrate identifiers to external services and trigger account actions users would not reasonably expect from a visual question-answering skill.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code enumerates workspace context, inspects environment variables and script paths, and creates agent-local data and skills directories. For a VQA-only skill, this filesystem and workspace discovery behavior is overprivileged and increases the chance of unintended data access or persistence beyond what is needed to answer image questions.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases for history-query activation are broad enough to overlap with ordinary conversation, making unintended invocation plausible. In a skill that accesses cloud-backed historical records, accidental triggering can disclose prior analysis metadata or links without a clear user request.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill accepts local files and URLs and indicates an API service will download or process them, but it does not clearly warn users that their content may be transmitted to a remote service. For images, documents, and videos, this omission is privacy-relevant because sensitive content may leave the local environment unexpectedly.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill sends user-supplied image references and questions to an external analysis service, but the CLI does not provide a clear user-facing notice that content may leave the local environment. This creates a data exposure risk for sensitive local images, remote URLs, and prompt contents, particularly in enterprise or regulated environments where users may assume local-only processing.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The code reads arbitrary local file contents and sends them to the analysis backend without any user-visible notice, consent flow, or contextual disclosure in this component. In a skill environment, that creates a meaningful privacy and data-handling risk because sensitive local media may be exfiltrated to a remote service under the guise of a simpler visual Q&A function.

Missing User Warnings

Low
Confidence
73% confidence
Finding
The skill forwards user-supplied remote URLs for analysis without clearly disclosing that external content will be fetched or processed. While this is less severe than silent local-file upload, it still creates trust and privacy issues and may trigger unintended access to third-party resources inconsistent with the skill's stated image-Q&A purpose.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2