T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/util.py:341- Finding
Authentication Credentials Exposed in Process Logs
- Content
View full analysis
- Remediation
View remediation
Security audit
高风险行为识别分析工具
Security checks for vulnerabilities and agentic risk
Overview
The skill’s stated video risk-analysis purpose is coherent, but it handles sensitive health and surveillance data while under-disclosing account creation, token storage, and credential exposure risks.
Review before installing. This skill may upload sensitive videos, images, stream URLs, identifiers, and risk results to external services, can create or reuse a remote account without an explicit separate consent step, and stores/logs reusable tokens locally. Do not use it with private health or surveillance footage unless the publisher documents account handling, token protection, report access controls, alert recipients, retention, and dependency updates.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/dao.py:57- Finding
Authentication Tokens Persisted in Plaintext SQLite Storage
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/risk_analysis.py:249- Finding
Historical Risk Report Query Is Sent Without the Required User Filter
- Content
View full analysis
`. 2. The CLI accepts ...[truncated 951 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skills/smyx_common/scripts/util.py:287- Finding
Supplying a User Identifier Can Trigger Undisclosed Silent Remote Registration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/face_analysis/scripts/skill.py:75- Finding
Mutable Default Parameter Can Leak Media URLs Across Analysis Requests
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (127)
Known Vulnerable Dependency: Authlib==1.6.6 — 14 advisory(ies): CVE-2026-28490 (Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle); CVE-2026-28802 (Authlib: Setting `alg: none` and a blank signature appears to bypass signature v); CVE-2026-41425 (Authlib: Cross-site request forging when using cache) +11 more
Critical
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The requirements file pins Authlib to a version identified by the scanner as carrying multiple critical advisories, including authentication and cryptographic verification flaws. In a skill that may process alerts, identities, APIs, or tokens, vulnerable auth/JWT/JWE handling can enable forgery, bypass, or account/session compromise.
- Content
Known Vulnerable Dependency: GitPython==3.1.45 — 16 advisory(ies): CVE-2026-78676 (GitPython: Dormant multi-line git-config values are corrupted into live injected); CVE-2026-67325 (GitPython: Command Injection via git long-option prefix abbreviation bypass of C); CVE-2026-73620 (GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagRefere) +13 more
Critical
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
GitPython is pinned to a version with multiple critical advisories including command injection and unsafe option forwarding. If the skill clones repositories, inspects git state, or handles repository paths from external input, this can yield remote code execution or unauthorized file operations.
- Content
Known Vulnerable Dependency: langchain-core==1.0.2 — 12 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa); CVE-2026-40087 (LangChain has incomplete f-string validation in prompt templates) +9 more
Critical
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
langchain-core is pinned to a version with multiple critical advisories including SSRF and prompt/template injection classes of issues. In an agentic skill that may fetch URLs, count tokens on image URLs, or render templates from dynamic content, these flaws materially raise the risk of internal network access, secret leakage, and unintended tool invocation.
- Content
Known Vulnerable Dependency: Authlib==1.6.6 — 14 advisory(ies): CVE-2026-28490 (Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle); CVE-2026-28802 (Authlib: Setting `alg: none` and a blank signature appears to bypass signature v); CVE-2026-41425 (Authlib: Cross-site request forging when using cache) +11 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The requirements file pins Authlib 1.6.6, and the finding lists multiple serious advisories including cryptographic and token-validation weaknesses. In a skill that likely handles authentication, API access, or signed tokens for video/alert workflows, vulnerable auth libraries can enable authentication bypass, token forgery, or cryptographic attacks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic login/account creation, token handling, credential persistence, and billing/recharge flows are major undeclared behaviors unrelated to the stated feature. These functions expose users to privacy, authentication, and financial risk while preventing informed consent about account and payment side effects.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes sending anomaly footage, risk type, and location to external recipients, but it does not present a clear privacy warning or consent flow for transmitting highly sensitive surveillance and health-related data. This is especially dangerous given the context: elderly care, medical precursor inference, continuous monitoring, and location sharing amplify harm if data is over-collected or disclosed.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions explicitly tell the agent to read an api-key from local configuration files and reuse it as a user's open-id. This is a direct secret-handling flaw: it repurposes stored credential material for user identity, encourages local secret discovery, and risks exposing or misusing privileged API keys during normal operation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow instructs collection of an open-id as a username or phone number without a clear privacy notice, minimization rationale, or handling policy. Collecting personal identifiers in a health/surveillance context materially raises privacy and compliance risk, especially when tied to historical reports and external APIs.
- Content
Known Vulnerable Dependency: click==8.3.1 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)
High
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
Click is pinned to a version reported as vulnerable to command injection. If this skill exposes CLI wrappers, task runners, or passes user-controlled values into command-related functionality, exploitation could lead to arbitrary command execution on the host.
- Content
Known Vulnerable Dependency: cryptography==3.4.8 — 16 advisory(ies): CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); GHSA-5cpq-8wj7-hf2v (Vulnerable OpenSSL included in cryptography wheels) +13 more
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
Cryptography 3.4.8 is old and flagged for multiple serious issues, including oracle-style attacks and bundled vulnerable OpenSSL concerns. Because this skill likely communicates with external services and may sign or validate tokens, cryptographic weaknesses can undermine confidentiality and integrity.
- Content
Known Vulnerable Dependency: httplib2==0.20.2 — 2 advisory(ies): CVE-2026-59939 (httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Respon); CVE-2026-59939 (httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, htt)
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
httplib2 is flagged for decompression-bomb denial-of-service. A network-facing skill that fetches remote resources, model inputs, or media can be forced into excessive memory/CPU consumption through crafted compressed responses.
- Content
Known Vulnerable Dependency: idna==3.11 — 2 advisory(ies): CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA): Specially crafted inputs ); CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA) for Python provides suppor)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
The pinned idna version is reported as vulnerable to specially crafted input handling issues. In systems that accept external URLs, domains, or callback endpoints, IDN parsing flaws can contribute to validation bypass, spoofing, or misrouting.
- Content
Known Vulnerable Dependency: langchain-openai==1.0.1 — 2 advisory(ies): GHSA-r7w7-9xr2-qq2r; PYSEC-2026-76
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
langchain-openai is reported vulnerable by published advisories. Because this package mediates model requests and potentially tool/response handling, weaknesses here can expose secrets, alter model interactions, or broaden prompt-injection impact.
- Content
Known Vulnerable Dependency: langgraph==1.0.2 — 2 advisory(ies): GHSA-g48c-2wqr-h844; PYSEC-2026-83
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
langgraph is pinned to a version with known security advisories. In a workflow/agent orchestration context, framework flaws can affect state handling, tool execution, and boundaries between trusted application logic and untrusted model outputs.
- Content
Known Vulnerable Dependency: langgraph-checkpoint==3.0.0 — 4 advisory(ies): GHSA-fjqc-hq36-qh5p; GHSA-mhr3-j7m5-c7c9; PYSEC-2026-2573 +1 more
High
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
langgraph-checkpoint is reported with multiple advisories, which is significant because checkpoint/state persistence often contains conversation context, credentials, or decision traces. Compromise here can lead to state tampering, data exposure, or unsafe resumption of privileged flows.
- Content
Static analysis
Detected: suspicious.install_untrusted_source
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- skills/smyx_common/scripts/config-dev.yaml:2