Fraud Call Identification Analysis Tool | 诈骗电话识别分析工具

• Outcome: Review
• Latest audit: Oct 15, 2026 · 9:51 AM UTC
• Version: 9.9.19

Overview

The skill claims to analyze fraud calls, but its packaged code uses broader cloud media-analysis plumbing with automatic identity creation, token storage, and history lookup behavior that users should review before installing.

Review this skill carefully before installing. It sends user-provided media or URLs to an external cloud service, can query cloud history tied to an internally managed identity, and can create/store local account tokens automatically. Install only if you accept that account-linked cloud workflow and the current mismatch between the fraud-call description and the generic/video-oriented implementation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of local file access, workspace inspection, identity/open-id resolution, local data reads, DB interaction, remote login/registration, and token management is far more invasive than the skill description suggests. In context, this is dangerous because users are led to provide call content for analysis while the implementation may silently create accounts, associate identities, and transmit data to cloud services.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "fraud-call-identification-analysis"
description: "Analyzes incoming call content for multi-dimensional risk, intelligently identifies scam scripts, determines if a call is fraudulent, assesses risk levels, and generates an Anti-Fraud Guardian analysis report. | 诈骗电话识别分析工具，针对来电通话内容进行多维度风险分析，智能识别诈骗话术，判断是否为诈骗电话并评估风险等级，输出反诈卫士分析报告"
version: "1.0.21"
license: "MIT-0"
---

# 📞 Fraud Call Identification Analysis Tool | 诈骗电话识别分析工具
> **智能分析中枢** · 图片/视频智能分析 ·

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The implementation materially conflicts with the declared skill purpose: it performs video analysis/history listing rather than fraud-call analysis. This kind of capability mismatch is dangerous because users may supply sensitive call data expecting one processing path while the code invokes an unrelated backend/functionality, undermining informed consent, security review scope, and trust boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code reads a workspace identity file and local user database, then recovers or creates persistent user identities automatically. For a fraud-call identification skill, silently binding to workspace identities is unrelated to the stated purpose and can enable tracking, impersonation, or unauthorized use of another local identity when making downstream requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility contains account provisioning, token recovery, authentication retry, and payment-related flows that are unrelated to fraud-call analysis. In the context of a call-content analysis skill, these hidden capabilities materially expand what the skill can do with local identities and external services, creating unnecessary risk of unauthorized account use, data transmission, and deceptive monetization flows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises behavior that requires shell, filesystem, environment, and network access, but the manifest does not declare any tool scope or least-privilege restrictions. That makes review and runtime enforcement harder and increases the blast radius if the skill or its backing scripts are compromised or behave unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The history-report trigger keywords are broad enough to fire on ordinary user language, which can cause unintended cloud queries and disclosure of historical report metadata. Because history access is identity-linked and automatic, accidental activation has real privacy implications beyond a mere usability issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill says attachments are automatically saved locally but does not clearly warn users up front in the primary description. Automatic local persistence of uploaded call media is privacy-sensitive and can create retention and exposure risk if users assume transient processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill omits a clear privacy warning that historical reports are fetched from a cloud API using internally managed identity association. That is dangerous because users may not realize their reports are linked to an internal identifier and queried remotely, which affects consent, privacy expectations, and data-governance obligations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script includes a hidden identity-related/listing path via --open-id and --list, which is not necessary for the advertised purpose of analyzing call content. Because it resolves a current identity and can list prior analysis data, it expands the skill into user-data access territory and may expose user-associated records or metadata if invoked in the wrong context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code presents the tool description, argument help text, and status/error messages only in Chinese, which imposes a specific language on all users. The file does not offer any language selection, locale negotiation, or documented justification for the restriction.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill accepts either arbitrary local file paths or arbitrary remote URLs and forwards the referenced content to a backend analysis API, even though the skill is described as analyzing incoming call content. This creates a capability mismatch that can be abused to exfiltrate unintended local files or fetch attacker-controlled remote content through the service, especially if callers can influence the input_path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code reads local file contents into memory or accepts a user-supplied URL and then submits that data to a remote analysis API without any visible consent prompt, warning, or trust boundary check in this module. In a skill environment, this can lead to inadvertent disclosure of sensitive local data or transmission of untrusted remote content to external services.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2