Security audit

jf-open-pro-algo-detection

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its AI detection purpose, but needs Review because it stores API secrets locally, can install another skill from an unpinned remote repo, and includes sensitive surveillance/tracking capabilities without enough guardrails.

Review this skill before installing. Use it only where you are authorized to process camera or image data, understand that calls may open or use paid platform capabilities, avoid installing the capture dependency from an unpinned remote source unless you trust that repository, and protect or remove config.json because it contains plaintext API credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill clearly instructs file writes and network access via local scripts, yet no declared permissions are present to make those capabilities explicit. This undermines least-privilege and informed consent because the host may activate a skill that can persist secrets, write result files, and contact external APIs without transparent permission metadata.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The public description frames the skill mainly as recommendation and analysis, but the body also performs account-affecting actions such as opening algorithm services, testing credentials, and persisting app secrets locally. That mismatch can mislead users and reviewers about the true trust boundary, causing unintended billing, credential handling, or external account changes.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The skill directs automatic installation of another skill by cloning or downloading a remote repository and copying files into the local skills directory. This creates a software supply-chain risk and local persistence vector, because remote content can change over time and the skill explicitly bypasses normal installation/review boundaries.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest promises a curated set of non-biometric, no-database detection algorithms, but the catalog includes human ReID, which is a tracking/biometric capability with materially different privacy and compliance risks. This mismatch can cause downstream agents or users to invoke person re-identification under a lower-risk description, enabling covert surveillance or policy bypass.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The catalog includes a video-processing/transformation feature ('时光缩影') rather than a pure detection or analysis algorithm, which breaks the contract implied by the skill description. Scope drift like this is risky because orchestration layers may grant the skill permissions or user trust appropriate for analysis only, while the skill exposes additional media-processing behavior.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: Human and license-plate obfuscation tools are materially different from the stated purpose of recommending detection algorithms and generating detection reports. Hidden redaction/transformation features expand the skill's operational scope and can be abused to alter evidence, process sensitive imagery in unexpected ways, or circumvent governance based on the declared skill function.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The file enumerates broad surveillance and workplace-monitoring capabilities—such as phone use, smoking, off-duty status, crowd gathering, theft, and ReID—without embedded guardrails on who may use them, under what circumstances, or what exclusions apply. In this context, the lack of trigger scope and activation constraints increases the risk of overbroad monitoring, misuse against sensitive populations, and deployment in unlawful or unethical scenarios.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script persists sensitive API credentials (uuid, appKey, appSecret) to a local config.json file in plaintext, and only masks the secret when printing it back to the console. If the host is multi-user, backed up to shared storage, committed accidentally, or readable by other local processes, the credentials can be stolen and used to access the external AI platform.

Static analysis

No suspicious patterns detected.