ClawHub
Back to skill

Security audit

Visual Summarization Skill | 视觉摘要智述技能

Security checks across malware telemetry and agentic risk

Overview

The skill performs visual analysis, but it also silently creates/reuses identities, stores tokens locally, and queries cloud report history, so users should review it before installing.

Install only if you are comfortable sending images, videos, and URLs to the publisher's cloud service and allowing the skill to maintain a local identity/token database. Avoid using it with private media or internal URLs unless the publisher documents retention, account creation, token storage, and cleanup controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
82% confidence
Finding
The list() method applies filters using getattr(self.__model__, key) where key comes from the caller. Although SQLAlchemy prevents classic SQL injection here, unvalidated attribute selection can let callers query on unintended model fields, including sensitive ones, and can raise exceptions for invalid names, enabling misuse or denial-of-service in higher-level flows. In this skill, that matters more because the same DAO also manages user and token-related records unrelated to the stated image/video summary purpose.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
The count() method repeats the same caller-controlled dynamic attribute lookup pattern as list(). This can expose metadata about restricted fields or support unauthorized enumeration of sensitive records, especially when used with the sys_user model containing identity and token-related data.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises no declared permissions, yet its documented behavior clearly involves shell execution, network access, local file read/write, and likely environment use. This is dangerous because users and policy systems cannot accurately assess the real privilege boundary, while the skill also persists identity state and calls remote services, increasing the chance of silent data exposure or unauthorized capability use.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented purpose is narrow visual summarization, but the skill behavior extends into remote history retrieval, local identity creation/reuse, token/account provisioning, and persistent credential storage. This mismatch is dangerous because it can mislead users into providing media while the skill performs hidden authentication, tracking, and record-linkage functions beyond reasonable expectations.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script includes a hidden capability to resolve an internal identity and list prior analyses via `--list` and a suppressed `--open-id`, which is unrelated to the advertised image/video summarization function. Because the identity parameter is intentionally hidden from help output and the code accesses analysis history based on internal identity state, this can expose metadata or prior outputs to users who invoke the skill in ways not aligned with its stated purpose.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill exposes report-listing and export-link functionality that goes beyond the declared purpose of generating a natural scene description from user-supplied image/video content. This expands the skill’s data-access surface and may allow users to enumerate prior analysis records or obtain report export URLs unrelated to the current request, creating privacy and authorization risks if upstream access control is weak or absent.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
This file exposes a generic API client with broad CRUD methods and arbitrary HTTP verb wrappers that can send requests to caller-supplied URLs, which materially exceeds a skill advertised as only analyzing visual content and generating summaries. In an agent/skill environment, this creates an unnecessary capability expansion that could be abused for unauthorized data access, backend interaction, or repurposing the skill as a general network proxy if higher-level controls are weak or bypassed.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The get_user_by_username capability enables user-account lookup that is unrelated to image/video scene description, indicating unnecessary access to identity-related functionality. Even if intended for internal convenience, such capability can facilitate user enumeration or unauthorized retrieval of account metadata when exposed through an agent skill with a mismatched declared purpose.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This skill claims to perform visual scene-description, but the DAO initialization forcibly creates and manages a persistent local SQLite database in a shared workspace data directory. Persistent cross-run storage and generic CRUD materially expand the skill's data-retention and lateral-access surface beyond what is necessary for visual summarization, increasing the risk of covert collection, correlation, or reuse of user data across agents or tasks.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The module defines a sys_user table with identity fields and token storage, capabilities that are unrelated to generating visual summaries. This introduces unnecessary collection and persistence of sensitive user information, creating confidentiality and misuse risks if the database is accessed by other components, agents, or an attacker.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code stores token and open_token values alongside user profile data even though the skill's declared purpose is visual-summary generation. Persisting authentication or access tokens in local SQLite significantly increases the impact of any filesystem exposure or cross-agent access, because token compromise can enable account or API abuse beyond this skill.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The docstring describes a lightweight local DB wrapper, but the actual path logic forcibly redirects databases into a shared workspace-level data store across agents. That mismatch is security-relevant because it obscures broader data-sharing behavior, undermining operator expectations and making unintended cross-agent data access more likely.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This utility for a visual scene-description skill performs unrelated account provisioning, token retrieval, token caching, and local persistence of user records. That is dangerous because it silently expands the skill's privilege and data-handling scope beyond user-visible media analysis, enabling hidden identity creation, credential storage, and outbound account-linked requests.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code detects workspace roots, creates persistent data directories, reads identity values from data/smyx-api-key.txt, and creates default local user identities. For a skill advertised as image/video description, this hidden persistence and identity lifecycle behavior is scope-inconsistent and increases privacy and abuse risk, especially in shared agent workspaces.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger rules are broad enough that ordinary requests involving images, videos, or report-related phrases may auto-activate the skill. In context, this is risky because activation can lead to local file saving and remote API interactions, causing unintended data processing or transmission without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that uploaded attachments are automatically saved locally, but it does not present a clear user-facing privacy warning near the primary description or consent flow. This is dangerous because sensitive media may be retained on disk unexpectedly, increasing the risk of privacy violations, over-retention, or later disclosure through the workspace.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill indicates that user-provided network URLs are handed to a remote API service for fetching, but it lacks a prominent privacy/security warning about this transfer. That creates risk because user-supplied URLs may contain sensitive resources or internal endpoints, and sending them to a third party can expose access patterns, private data, or enable unintended remote retrieval behavior.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code sends either a remote video URL or raw local file content to an external analysis service without any visible consent notice, data-handling disclosure, or trust boundary indication in this file. For image/video content, this can expose sensitive personal or proprietary data to third-party processing unexpectedly, especially when users may assume local-only summarization from the skill description.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
When debug mode is enabled, urllib3/http.client logging is turned on globally, which can expose request URLs, bodies, and responses containing tokens, open IDs, or user content. Even if intended for development, this creates a real confidentiality risk if debug mode is enabled in production or logs are collected centrally.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The code reads an internal identity value from a workspace file and uses it as the current open-id without clear user disclosure or validation. While not intrinsically exploitable on its own, it can cause unintended identity reuse or cross-context actions if the workspace file is stale, injected, or shared among agents.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
The skill sends externally derived identity data to a remote /sys/phoneLogin endpoint to create or retrieve a user account, which is unrelated to the stated visual-analysis purpose. In this context, external transmission is more dangerous because it is coupled to silent registration behavior and can disclose or establish persistent user identity without clear consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2