T09 · Insecure Skill Coding Practices
Warning
- Location
skills/smyx_common/scripts/util.py:576- Finding
Authentication Tokens Persisted in Plaintext Workspace Database
- Content
View full analysis
- Remediation
View remediation
Security audit
Video Search test
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its video analysis purpose, but it quietly creates or reuses cloud identities, stores tokens locally, and sends videos or URLs to remote services with weakly scoped controls.
Install only if you are comfortable with provided videos, video URLs, search text, and report history being processed by lifeemergence.com services. Treat this as an account-linked cloud skill: review how identities are assigned, where tokens are stored, and whether the workspace data directory is private before using it with sensitive surveillance, personal, or business media.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/smyx_common/scripts/util.py:568- Finding
HTTP Helper Can Forward Vendor Credentials to Arbitrary Absolute URLs
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
skills/smyx_analysis/requirements.txt:1- Finding
Ambiguous YAML Dependency Declaration Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (58)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic user/open-id resolution, local user database access, reading a workspace credential file, backend authentication, token retry logic, and generic HTTP requests indicate identity and secret-handling capabilities far beyond the declared purpose. In this context, that is especially dangerous because the skill also instructs silent internal identity handling, reducing transparency and increasing the risk of unintended account linkage or credential misuse.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: "video-search-analysis" description: "Conducts intelligent video search based on target and semantic descriptions; supports conventional target retrieval, natural language description retrieval, and vectorized model matching. | 视频搜索/视频检索智能分析技能，基于目标、语义描述进行智能视频搜索，支持常规目标检索、自然语言描述检索、向量化模型匹配" version: "1.0.5" license: "MIT-0" --- # 🔎 Intelligent Video Search & Retrieval Analysis Skill | 视频搜索检索智能分析技能 > **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a video search skill supporting target retrieval, natural-language description retrieval, and vectorized model matching. In this file, the implemented operations upload a local or remote video to an analysis endpoint, poll for analysis completion, and list/export analysis reports; there is no code for search queries, target matching inputs, semantic retrieval, or vector/vectorized matching behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The utility silently creates or reuses user identities, obtains tokens from a remote service, and persists token-bearing user records locally. For a video-search skill, this is over-privileged shared behavior that can exfiltrate identity context and establish lasting authentication state unrelated to the declared purpose, increasing the blast radius if the skill is abused or compromised.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises executable behavior that implies shell, filesystem, environment, and network access, but the manifest does not declare any tool scope or allowed-tools boundary. That weakens least-privilege enforcement and makes it harder for a host platform to constrain what the skill may access if invoked.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The default trigger condition is broad enough to activate on ordinary requests about finding content in videos, which can cause unintentional execution of a networked, file-handling skill. Given the other findings about hidden backend and identity behaviors, overbroad activation increases the probability of accidental data transfer or processing without informed user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that uploaded files are saved locally and URLs are sent to a remote API service, but the description does not clearly warn users about this data flow. This is dangerous because video files and URLs may contain sensitive information, and silent local persistence plus remote transfer can violate user expectations or policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill enforces automatic internal identity association and may silently fall back to a default local user or create one without user choice. In a multi-user or regulated environment, this can misattribute actions, expose another user's history, or mix data across identities without explicit consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest says the skill supports natural-language description retrieval, which implies users should be able to search by description alone. However, the main argument validation exits unless --input or --url is provided, so text-only retrieval is not actually supported by this entrypoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The tool initiates remote video analysis through skill.get_output_analysis using user-supplied local paths or URLs, but the CLI provides no explicit notice, consent gate, or privacy warning before potentially transmitting sensitive video content or descriptive text to backend services. In a video-search skill, this is more dangerous because inputs may contain surveillance footage, personal data, or confidential media, increasing privacy and compliance risk.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code reads the entire local file and prepares it for upload to a remote analysis service without any user-facing disclosure, consent checkpoint, or warning in this file. In an agent skill context, that creates a privacy and data-handling risk because sensitive local video content may be transmitted off-host unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code file accepts a hidden
--api-keyargument and then invokes video analysis functionality that appears to call a remote service, but the user-facing CLI help does not disclose the credential-handling behavior. Under the code-file criteria, sensitive credential use tied to network operations should have some visible warning, comment, or user-facing disclosure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The methods in this file transparently transmit data over the network through helper wrappers, but the file provides no disclosure, auditing hooks, or indication of what data may leave the local environment. In an agent skill, silent network transmission is risky because user-provided search terms, identifiers, usernames, and object keys may be sent to remote services without clear consent or visibility, enabling unintended data exposure.
- Content
Static analysis
Detected: suspicious.install_untrusted_source
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- skills/smyx_common/scripts/config-dev.yaml:2