T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/config.yaml:4- Finding
Private Surveillance Video and Authentication Data Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Elderly Long-Term Immobility Monitoring (>12h) | 老年人长期静止（超12小时）监测
Security checks for vulnerabilities and agentic risk
Overview
The skill is related to elder-monitoring video analysis, but it silently creates and reuses identities, stores service tokens, and is configured to send sensitive video and credentials over plaintext development HTTP endpoints.
Review this carefully before installing. It handles extremely sensitive in-home video and historical safety reports, creates or reuses an internal account identity automatically, and may store reusable service tokens locally. Do not use it for real household monitoring unless the publisher removes the dev HTTP configuration, uses HTTPS-only allowlisted endpoints, clearly documents account creation/token retention/deletion, and confirms consent, retention, and access-control practices.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/smyx_common/scripts/util.py:548- Finding
Authentication Credentials Are Automatically Attached to Arbitrary Absolute URLs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/smyx_common/scripts/util.py:548- Finding
Silent Remote Account Registration Persists Service Tokens in Unencrypted Database Fields
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (53)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic remote login/account creation, token handling, persistent open-id generation, workspace discovery, and file access are high-sensitivity operations that are not transparently disclosed by the stated purpose. In a skill processing in-home elder surveillance data, these hidden identity and storage behaviors substantially elevate privacy, consent, and unauthorized data correlation risks.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
When no identity is provided, the code silently creates a synthetic default user in a local database and then reuses it. For a home-monitoring alert skill, this creates an undisclosed identity lifecycle and enables backend interactions under fabricated or implicit accounts, which can misattribute actions, weaken auditability, and expose user data to external services without informed consent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The utility layer performs remote account login/registration, caches tokens, and persists user identity data even though the skill is described as elderly immobility video monitoring and alerting. That is a material capability expansion: the code can create or reuse identities and communicate with external health-related services without clear necessity or user consent, increasing the risk of unauthorized account actions and privacy leakage.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The manifest documents capabilities that involve shell execution, network access, file reads/writes, and environment use, but it does not declare any tool scope or permission boundaries. This creates a least-privilege failure: an agent may invoke powerful operations implicitly, making misuse, unintended data access, or command execution harder to govern and audit.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation expands the input surface from continuous video monitoring to still images, arbitrary local files, and URLs. Broader input modalities increase the chance of unintended file access, ingestion of sensitive local content, or server-side fetching of untrusted remote resources that users may not expect from the declared camera-monitoring scenario.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
An overly broad default trigger can cause the skill to activate on uploaded home-monitoring media whenever analysis is requested, even when the user did not intend elder-care processing. Because the skill may perform file handling, network/API calls, and identity-linked reporting, accidental invocation can expose sensitive household footage to unnecessary processing paths.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill exposes cloud-based historical report querying and listing beyond the primary activity-detection use case, but this secondary data-access interface is only partially disclosed. In a system handling elder-care reports, expanding into history retrieval increases the risk of over-collection, unintended disclosure, or access to past sensitive records.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Broad auto-trigger keywords for history-report retrieval can cause unintended access or display of prior sensitive reports without strong intent verification. In this context, accidental retrieval of elder-care history is a meaningful privacy risk because reports may be identity-linked and contain health-adjacent safety events.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document describes continuous in-home camera monitoring across private spaces and emergency alerting, but provides no privacy notice, consent requirements, retention limits, access controls, or guidance for handling highly sensitive personal data. In the context of monitoring an elderly person inside a home, especially including bedroom and bathroom coverage, this omission can lead to invasive surveillance deployments, unauthorized disclosure, and non-compliant processing of sensitive data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The hardcoded user-facing string on L17 is entirely in Chinese and provides no indication that language is configurable or selected based on user preference. This creates a natural-language policy concern because the skill appears to enforce a specific language/locale without opt-in or documented justification in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id() without meaningful user disclosure and even suppresses the related CLI option from help output. In a monitoring tool handling highly sensitive in-home elder video analysis and alert history, hidden identity binding can cause actions or data retrieval to occur under an unexpected account, creating privacy, authorization, and auditability risks.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-facing output headers and messages are hard-coded in Chinese, such as the report title and export-link text. Because this is a code file and there is no indication that the skill is region-specific or that users can opt into the locale, this appears to violate the language/locale policy for natural-language content.
- Content