T08 · Insecure Dependencies
Warning
- Location
SKILL.md:20- Finding
Unpinned Third-Party Dependency Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
H test
Security checks for vulnerabilities and agentic risk
Overview
This restaurant camera inspection skill appears purpose-aligned, but it handles live camera images and Ezviz secrets in ways that can expose sensitive data, so it needs review before installation.
Install only in an environment where you are authorized to capture and analyze the camera feeds. Prefer environment variables or a secret manager over command-line secrets, remove or gate debug logging before production use, pin dependencies, rotate any secret previously passed in shell history, and confirm privacy/legal requirements for employee or customer imagery sent to Ezviz services.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/restaurant_inspection.py:144- Finding
Application Secret Can Be Exposed Through Command-Line Arguments
- Content
View full analysis
= 6: app_key = sys.argv[1] app_secret = sys.argv[2] device_serial = sys.argv[3] channel_no = sys.argv[4] agent_id = sys.argv[5] analysis_text = sys.argv[6] if len(sys.argv) > 6 else DEFAULT_ANALYSIS_TEXT ``` The documented invocation explicitly places the secret on the command line: ```bash python3 {baseDir}/scripts/restaurant_inspection.py appKey appSecret dev1 1 agentId ``` ### Technical Analysis The script accepts the Ezviz application secret as a positional command-line argument. Command-line arguments are generally not an appropriate transport for long-lived credentials because they may be exposed through: - Shell command history - Process inspection interfaces and process-monitoring tools - Job schedulers and orchestration metadata - Terminal session recording - Audit logs and support diagnostics - Wrapper scripts that retain the complete invocation The environment-variable alternative reduces exposure in shell history but may still be visible to processes or diagnostic tools with sufficient access. A protected secret manager, inherited file descriptor, or secure interactive prompt provides stronger handling. ### Attack Path 1. A user invokes the script using the documented positional-argument format and includes the real `appSecret`. 2. The shell records the invocation in history, or a local process-monitoring, scheduling, or logging system captures the process arguments. 3. An attacker or unauthorized operator with access to that history or telemetry retrieves the application key and secret. 4. The attacker submits the stolen credentials to the documented Ezviz token endpoint. 5. If the credentials remain valid, the attacker obtains an access token. 6. The attacker can then in ...[truncated 829 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/restaurant_inspection.py:103- Finding
Unconditional Debug Logging May Disclose Sensitive API Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md return os.getenv(env_var) or arg_value or default def get_access_token(app_key, app_secret): """Get access token from Ezviz API""" print("=" * 70) print("[Step 1] Getting access token...")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return os.getenv(env_var) or arg_value or default def get_access_token(app_key, app_secret): """Get access token from Ezviz API""" print("=" * 70) print("[Step 1] Getting access token...")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return os.getenv(env_var) or arg_value or default def get_access_token(app_key, app_secret): """Get access token from Ezviz API""" print("=" * 70) print("[Step 1] Getting access token...")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return os.getenv(env_var) or arg_value or default def get_access_token(app_key, app_secret): """Get access token from Ezviz API""" print("=" * 70) print("[Step 1] Getting access token...")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return os.getenv(env_var) or arg_value or default def get_access_token(app_key, app_secret): """Get access token from Ezviz API""" print("=" * 70) print("[Step 1] Getting access token...")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill requires environment-variable access and outbound network access to third-party endpoints but does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch can cause the runtime or user to underappreciate what the skill is capable of, increasing the chance of unintended secret exposure or unauthorized external communication.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description forces Chinese-language interaction/documentation at the top-level description, and the rest of the file continues in Chinese without indicating that users may choose another language. This can violate language/locale policy requirements when no user opt-in or documented locale restriction is provided.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The skill explicitly transmits sensitive operational data off-host: camera images, device identifiers, prompts, and an access token to remote Ezviz services. In this restaurant/kitchen surveillance context, those images may contain people, work practices, and private premises details, so external transmission materially increases privacy, confidentiality, and compliance risk.
- Content
AI 智能体分析接口调用格式:
bash curl --location --request POST 'https://aidialoggw.ys7.com/api/service/open/intelligent/agent/engine/agent/anaylsis' \ --header 'accessToken: YOUR_ACCESS_TOKEN' \ --header 'Content-Type: application/json' \ --data-raw '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script captures images from restaurant devices and sends the image URL plus analysis prompt to an external AI service, but it provides no explicit privacy notice, consent check, data-classification control, or retention guidance. In a restaurant or kitchen setting, imagery may contain employees, customers, operational details, or other sensitive visual data, so silent external transmission creates a real privacy and compliance risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The code transmits image-derived data to an external analysis endpoint, which is an actual data egress path. Although external transmission is part of the skill's intended function, it still represents a security-relevant boundary crossing because sensitive camera imagery and operational context leave the local trust boundary and are sent to a remote service.
- Content
python try: print(f"[INFO] Sending analysis request to: {ANALYSIS_URL}") response = requests.post(ANALYSIS_URL, json=payload, headers=headers, timeout=60) # Debug output print(f"[DEBUG] Payload: appId={agent_id[:8]}..., mediaType=image, text={analysis_text[:50]}..., dataType=url, data={pic_url[:30]}...")
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The default analysis prompt is entirely in Chinese and instructs the model to produce categorized inspection output, but the file does not indicate that Chinese is optional or that the skill is intentionally restricted to a Chinese-language workflow. This can violate language/locale policy when users are not given a choice or opt-in.
- Content
Static analysis
No suspicious patterns detected.