Security audit

jf-open-algo-assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it needs Review because it can send surveillance images to a third-party API, store API secrets locally, and install another skill from an unpinned remote repository.

Install only if you trust JFTech and are authorized to send the target images, camera identifiers, and analysis results to its API. Review local handling of config.json because it stores API secrets in plaintext, avoid sensitive or regulated imagery unless you have consent and a lawful basis, and do not use the automatic dependent-skill install path unless you have independently reviewed and pinned the remote jf-open-pro-capture source.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly performs network access to external APIs and writes local files such as config.json and result/output artifacts, yet no explicit permissions model is declared. This creates a transparency and consent problem: users or hosting platforms may not realize the skill can exfiltrate data to remote services and persist sensitive material locally.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The workflow instructs the agent to automatically install another skill by cloning a remote repository or downloading a zip and copying files into the local skills directory. This is a supply-chain and arbitrary local code deployment risk, because it introduces unreviewed remote content into the trusted execution environment and even suggests proceeding by directly reading the installed SKILL.md without a normal trust/reload boundary.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documented workflow expands from its stated purpose of algorithm invocation into dependency acquisition and local skill deployment. That broader operational scope increases attack surface by allowing the skill to modify the user's environment and bootstrap additional capabilities that may not have been expected when invoking an image-analysis assistant.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The catalog includes person re-identification capability despite the skill description claiming exclusion of comparison-style algorithms. ReID materially increases tracking and cross-scene linkage risk, enabling persistent surveillance of individuals without clear disclosure or constraint.

Missing User Warnings

High

Confidence: 91% confidence
Finding: Customer age/gender analysis processes sensitive personal attributes and can support profiling or discriminatory monitoring if presented without privacy warnings. In a surveillance-oriented assistant that recommends and invokes analysis on images and camera captures, omission of consent, retention, and use-limit guidance materially raises misuse risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Employee behavior monitoring such as phone use detection introduces workplace surveillance risk and can be misused for covert monitoring or punitive profiling. The skill is specifically designed to guide users into selecting surveillance algorithms, so lack of warnings and governance language increases the chance of inappropriate deployment.

Missing User Warnings

High

Confidence: 95% confidence
Finding: Person re-identification and tracking are highly sensitive because they enable following an individual across frames, cameras, or contexts. In this assistant, which helps users invoke image and camera analysis, exposing ReID without strong privacy warnings or constraints substantially heightens surveillance and abuse potential.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The document instructs users to send image URLs or base64 image content plus device serial numbers to a remote third-party API, but gives no privacy, consent, retention, or data-handling warning. In a skill focused on camera captures and image analysis, this omission increases the risk that sensitive visual data, identifiers, or regulated personal information will be transmitted without informed handling controls.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The async callback description notes that users can provide a callback URL, but omits a warning that analysis results and alerts will be pushed to that destination. That can lead to accidental disclosure of detection results, metadata, or sensitive operational events to improperly controlled endpoints, especially in surveillance and workplace-monitoring contexts.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The client stores API credentials, including appSecret, in a local JSON file without any permission hardening, encryption, or explicit warning to the user. In a skill that handles remote API access, this increases the chance that secrets are left in plaintext on disk and later exposed through local compromise, backups, logs, or accidental sharing.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code accepts either a URL or local image path, then sends the image content or remote image reference to an external API endpoint without any explicit confirmation, privacy notice, or data classification check. Because this skill is specifically for image and camera analysis, it may process surveillance or operationally sensitive imagery, making silent transmission to a third party a meaningful confidentiality risk.

Static analysis

No suspicious patterns detected.