Back to skill

Security audit

生命涌现设备管理

Security checks across malware telemetry and agentic risk

Overview

This camera-management skill needs review because it can control and expose surveillance devices, bundles unrelated face/health-analysis code, and handles account tokens with weak disclosure.

Install only if you trust the publisher with camera device control, live surveillance links, account identity, and stored tokens. Before use, require explicit confirmation for delete/control/audio/stream actions, avoid using real camera credentials unless storage is secured, and remove or separately review the bundled face/health-analysis module if you only need device management.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (28)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
83% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The documentation instructs the skill to source open-id values from local configuration files or user/session context before performing device operations. Pulling identifiers from files outside the immediate user request expands the data-access scope and can cause the skill to act on behalf of a different user without clear consent.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill explicitly parses sessionKey metadata to extract a DingTalk chat_id/open-id and reuse it automatically for API calls. This is dangerous because it repurposes cross-channel session metadata as an authorization identifier, which can enable identity confusion, unauthorized access to another user's devices, or silent handling of personally identifying data.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill metadata and help text describe device CRUD, live viewing, and stream retrieval, but the code also exposes active remote-control functions for PTZ movement and audio toggling. In a device-management context for cameras and monitoring systems, this hidden capability materially expands the action surface from read/manage operations to physical surveillance control, which can enable unauthorized monitoring changes or disruption if invoked by an agent or user who did not expect such powers.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The module documentation understates the script's capabilities by omitting remote camera control while claiming status monitoring that is not actually implemented. This kind of capability misrepresentation is dangerous because reviewers, operators, or orchestration systems may grant trust or approval based on incomplete descriptions, allowing higher-risk actions than intended.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The README documents a medical face-analysis skill, but the declared skill metadata is for device management of cameras and monitoring streams. This mismatch is dangerous because it can misroute user requests and cause operators or users to invoke a capability that processes sensitive biometric/health-related video under the guise of a different tool, undermining review, consent, and least-privilege expectations.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The referenced API documentation is for face analysis and explicitly includes health/constitution diagnosis outputs, which is unrelated to the stated device-management purpose of managing cameras and viewing live streams. This kind of cross-domain capability expansion is dangerous because it enables sensitive biometric and health inference processing under a skill context where users would not reasonably expect medical-style profiling, increasing the risk of covert surveillance or inappropriate data use.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The documented response includes medical or quasi-medical inferences such as organ condition, constitution, complexion interpretation, health warnings, and suggestions derived from facial video. In a device-management skill, this is unjustified sensitive inference and materially raises harm because users may be profiled or receive health-related assessments without informed consent, proper validation, or a legitimate functional need.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file implements TCM facial-analysis processing, accepts local files/URLs, and produces health-style diagnostic output, which materially differs from the declared device-management skill for cameras/monitoring. In a skill ecosystem, this mismatch is dangerous because it can cause the wrong tool to be invoked on sensitive user inputs and can silently expand data handling into biometric/health-related processing outside the documented scope.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The function signature and docstring imply remote API-based analysis with configurable api_url/api_key, but those security-relevant parameters are ignored and input is forwarded directly to local skill logic. This discrepancy can mislead reviewers and operators about where data is sent, what controls apply, and whether authentication or endpoint restrictions are enforced.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The implementation is a face/health analysis skill that uploads media and returns health-related report content, while the manifest declares a device-management capability for cameras/monitoring. This capability mismatch is dangerous because it can cause the agent to invoke this skill in a device-management context and unexpectedly send camera/video content to a remote face-analysis backend, violating user expectations, least privilege, and potentially privacy boundaries.

Context-Inappropriate Capability

Medium
Confidence
78% confidence
Finding
The model stores sensitive authentication material such as token and open_token in plaintext in a local SQLite database. In a device-management context, this is more dangerous because the skill may have access to surveillance systems or streaming endpoints, so token disclosure could lead to unauthorized access to cameras, live feeds, or linked accounts.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill declared for device management includes a generic AI chat/agent invocation capability that is outside its stated purpose. Even though the subprocess execution is currently disabled, this creates an unnecessary high-risk extension point for arbitrary prompt handling and future command execution in a privileged skill context.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The shared HTTP utility performs unrelated identity and billing flows, including auto-login/registration via /sys/phoneLogin and returning payment-skill upsell instructions on HTTP 402. For a device-management skill, embedding account provisioning and monetization logic in a generic request helper creates hidden side effects and can trigger user/account actions far outside the declared purpose.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code auto-registers or logs in a user based solely on a username/phone value by calling /sys/phoneLogin with register=1 and mobile/openId derived from that identifier. This can create or bind accounts without explicit user consent or proof of control over the phone/identity, which is especially risky in a device-management context where accounts may govern access to cameras or monitoring resources.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger rules are very broad and include common phrases such as cameras, monitoring, device lists, and live view requests. Because the skill can perform destructive and privacy-sensitive actions, overbroad invocation increases the chance of accidental activation and unintended access to device information or controls.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill includes high-risk operations such as device deletion, PTZ control, audio control, and live stream retrieval, but it instructs automatic execution for some requests and does not require explicit confirmation or warning. This can lead to unauthorized surveillance, device disruption, or accidental destructive changes if a request is ambiguous or socially engineered.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The script accepts username and password fields and persists device data to a local YAML config file without encryption, secret isolation, or access-control hardening. If the host filesystem, backups, logs, or adjacent processes are exposed, attackers can recover device credentials and pivot into cameras or related internal infrastructure.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README instructs users to analyze local or network video via an external API endpoint but does not clearly warn that facial video may be transmitted to a third-party service. Because face video can contain biometric and health-related data, omission of this disclosure creates a privacy and compliance risk and may lead to unintentional exfiltration of sensitive content.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The documentation states that analysis results are automatically saved to a file without warning that sensitive outputs may persist locally. Since the results may include health inferences or biometric-related assessments, silent local persistence increases the chance of unintended disclosure through shared machines, backups, or insecure file permissions.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The API accepts uploaded video files or public video URLs but the documentation provides no warning about privacy, retention, sharing, or handling of the submitted video content. Because video of people may contain biometric and highly sensitive personal data, the absence of user-facing data-handling guidance increases the risk of unauthorized collection, transmission, and misuse, especially when paired with face-analysis behavior.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The CLI initiates facial-analysis on local files or URLs and requests a user identifier, yet provides no explicit warning, consent prompt, or disclosure about biometric/privacy implications. In the context of a mislabeled device-management skill, this is more dangerous because users may not expect face-analysis or health-related inference, increasing the risk of collecting and processing sensitive data without informed consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill reads local file contents or accepts remote video URLs and sends them to an external analysis API without any visible user-facing notice, consent step, or data-handling disclosure in this file. Because the content can be facial/health-related imagery, the privacy risk is elevated: users may unknowingly upload sensitive biometric or medical-adjacent data to a remote service.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
This utility automatically sends request bodies, query parameters, and authentication headers to remote endpoints without any visible consent or disclosure boundary in the skill logic. In a device-management skill, those fields may contain tenant identifiers, usernames, or camera-related metadata, so silent transmission increases privacy and security risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2