Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the advertised driver fatigue video analysis, but it also silently creates or reuses identities, contacts cloud services, and stores authentication/profile data for sensitive driver-monitoring reports.
Review before installing. Use this only if you are comfortable sending driver-facing video or URLs to the LifeEmergence cloud service and having report history tied to an automatically managed identity. Ask the publisher for retention, deletion, consent, and token-storage details, and avoid using it with production fleet or employee footage until those controls are clear.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The skill claims real-time DMS-based fatigue detection while also performing network requests, token-authenticated API access, local directory manipulation, and user identity/credential storage. In combination, this is a materially broader and more sensitive behavior set than advertised, affecting both privacy and system integrity in a context involving biometric-derived data.
The description does not clearly warn users that historical reports and event data may be transmitted to and stored in the cloud, despite involving sensitive driver video-derived biometric and behavioral data. In this context, omission of that disclosure is serious because users may unknowingly expose privacy-sensitive information and organizations may violate consent or compliance requirements.
The skill claims to perform driver blink/fatigue analysis, but this file implements persistent user-account storage and lookup logic unrelated to that purpose. That mismatch increases the risk of unnecessary collection and retention of identity data, and in a safety-focused in-cabin context it broadens the privacy attack surface without clear justification.
The schema stores tokens, open_token, email, birthday, real name, and other profile data, none of which are justified by the stated blink/fatigue detection purpose. In an in-cabin monitoring skill, collecting unrelated authentication-like secrets and personal data materially increases privacy and account-compromise impact if the local database is accessed or exfiltrated.
The code resolves or creates default open-id values, reads identity data from local files, and persists generated identities for future reuse. For a fatigue-detection skill, automatic identity creation and persistence are unjustified and expand the privacy and account-abuse surface if the environment or local storage is compromised.
This utility file implements broad remote account provisioning, token management, and authenticated API communication that is unrelated to the stated blink/fatigue detection purpose. In the context of an in-cabin vision skill, this hidden identity and network behavior materially increases data-handling and abuse risk because the skill can establish external accounts and transmit user-linked metadata without necessity.
The code performs automatic remote phone-login/registration using a constructed identity, retrieves tokens, and stores returned user records locally. This is dangerous because it creates external accounts and establishes authenticated sessions without a clear relation to the declared fatigue-monitoring function, enabling silent data linkage and unauthorized service use.
The skill declares broad operational behavior including shell execution, network access, file reads/writes, and environment usage, but does not declare any explicit tool scope or permission boundaries. This makes the skill harder to review and increases the chance that an agent executes powerful actions unexpectedly, especially because the document instructs command execution and cloud access.
The skill includes cloud historical-report querying that goes beyond the stated real-time blink/fatigue detection purpose. In a driver-monitoring context, this expands access to sensitive historical biometric-derived records and should be treated as a separate privileged capability rather than an incidental feature.
The automatic trigger for historical report queries is broad enough that ordinary reporting-related language may cause cloud retrieval of sensitive records without sufficient contextual confirmation. Because the data concerns driver monitoring and possible fatigue events, accidental invocation raises privacy and overreach concerns.
Automatic local user fallback and user creation are unrelated to the advertised analysis task and introduce hidden identity persistence. This is risky because the skill may silently create or bind identities for sensitive report access without transparent consent, audit clarity, or least-privilege boundaries.
The method returns a fixed Chinese-language string with no indication that the user can choose a language or locale. This can violate a language/locale policy when the skill is used in broader contexts where users have not opted into Chinese output.
The skill exposes a history/list retrieval function keyed by open_id even though the stated purpose is real-time fatigue analysis of a provided video. This expands the data-access surface to potentially include prior analysis records and creates an insecure direct object reference/privacy risk if open_id values can be influenced, guessed, or reused across users.
Detected: suspicious.install_untrusted_source
