Fraud Call Identification Analysis Tool | 诈骗电话识别分析工具

• Outcome: Review
• Latest audit: Aug 30, 2026 · 4:41 AM UTC
• Version: 9.9.15

Overview

This skill wraps a remote fraud-analysis service, but it needs Review because it silently manages user identity and tokens, stores local account state, and its implementation is broader and more video-oriented than the fraud-call description.

Install only if you are comfortable with call/media content, submitted URLs, report-history requests, and internal identity metadata being sent to Life Emergence/Open API services, and with the skill creating a local SQLite account/token store in the workspace data directory. Reviewers should require clearer scoping, consent, and retention behavior before broad deployment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 84% confidence
• Finding: Using getattr(self.__model__, key) with unvalidated filter keys lets callers choose arbitrary model attributes at runtime. While SQLAlchemy still parameterizes values, this can expose unintended columns, trigger errors for missing attributes, and enable unauthorized querying against fields the caller should not control; in a shared generic DAO, that broadens data access beyond the skill's stated fraud-analysis purpose.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 82% confidence
• Finding: The count() path repeats the same unvalidated dynamic attribute selection as list(), allowing callers to probe arbitrary model fields. Even without SQL injection, this can facilitate schema discovery, sensitive-field inference, and unauthorized metadata queries in a component that already manages user records unrelated to the advertised skill behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises executable capabilities including shell, network, file read/write, and environment access but declares no permissions boundary or user-facing consent model. In this context, the skill also instructs automatic local saving of attachments and cloud/API access, so the missing permission declaration weakens transparency and increases the chance of over-privileged execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is narrow fraud-call analysis, but the observed behavior expands into remote account registration/login, local token persistence, local SQLite identity storage, historical report retrieval, and handling of generic files/URLs. That mismatch is dangerous because users and orchestrators may authorize the skill for simple content analysis without realizing it performs identity management, persistent storage, and broader data exfiltration to a backend.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code implements a video-analysis CLI while the manifest advertises fraud phone-call identification. This semantic mismatch is dangerous because users and orchestrators may grant the skill access or trust based on the declared anti-fraud purpose, while the actual implementation processes different inputs and may invoke unrelated backend behavior through skill.get_output_analysis(). In an agent ecosystem, this kind of capability misrepresentation can bypass user expectations, policy checks, or review assumptions.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The function names, docstrings, and CLI help consistently describe video analysis, directly contradicting the manifest's fraud-call analysis purpose. This increases the likelihood of operator confusion, unsafe invocation, and incorrect security review because the declared trust boundary and the actual behavior are inconsistent. In security-sensitive agent skills, misleading documentation is itself a meaningful risk signal.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file exposes a generic HTTP wrapper plus CRUD-style helpers that can send requests to arbitrary URLs, which materially exceeds the stated purpose of a fraud-call analysis skill. In a skill context, this creates a broad capability surface for outbound communication and remote actions that could be repurposed for data exfiltration, unauthorized API access, or hidden side effects unrelated to call-analysis.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The add, edit, delete, http_post, http_put, and http_delete methods provide direct remote resource modification capabilities without any visible restriction tying them to the declared anti-fraud function. That means code using this service could alter external systems or trigger destructive actions through arbitrary endpoints, which is especially dangerous in an agent skill where users would not expect generic write/delete network behavior.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This file defines generic user/account persistence (sys_user plus CRUD) even though the skill is described as analyzing call content for fraud. That capability mismatch increases attack surface and creates opportunities to store, correlate, or mutate identity data unrelated to the declared purpose, which is especially sensitive in a security-oriented skill users may trust with personal information.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The DAO initializes and mutates a local SQLite database, including schema creation and alteration, which is broader than a read-mostly analytical tool would normally require. In context, silent local persistence can retain sensitive user or call-related data beyond user expectations and expand the blast radius if the workspace is shared or later accessed by other agents/components.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This utility layer performs broad remote API access, token handling, retry logic, and even account bootstrap behavior that goes well beyond a fraud-call analysis skill's stated purpose. In the context of a call-analysis skill, hidden authenticated network operations materially increase the risk of undisclosed data exfiltration, misuse of local identities, and unauthorized actions against external services.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads an identity value from a local file, reuses existing local identities, and creates default user identities when none exist. For a fraud-call identification skill, this is unrelated capability expansion that can silently bind the skill to persistent local or remote identities without the user's informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The workspace discovery functions inspect runtime paths, environment variables, and create directories for agent data/skills. While not directly exploitable on their own, they expand the skill's filesystem awareness and persistence footprint beyond what is necessary for simple call-content analysis, increasing the blast radius if combined with other behaviors.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The history-report trigger includes broad natural-language phrases for automatic activation, which can cause the skill to query cloud history when a user is only discussing reports conversationally. Because history retrieval is tied to internal identity and remote API access, accidental triggering can disclose prior records or cause unintended backend actions.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default activation rule is overly broad, allowing ordinary file/text analysis requests to invoke this skill automatically whenever audio, files, or text are present. In a skill with shell, network, and file-handling behavior, broad auto-triggering raises the risk of unintended uploads, local file processing, and backend calls on content the user did not intend for anti-fraud analysis.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow states that uploaded attachments, including videos and images, are automatically saved as local files, but the skill description does not clearly warn users about this persistence behavior. Silent local storage increases privacy and retention risk, especially for sensitive call recordings or unrelated media that may contain personal data.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: This code reads the entire local file and submits it to the analysis service without any visible user-facing consent, warning, or minimization step. In a skill handling potentially sensitive call content, that can cause unintended disclosure of private recordings or other uploaded material to a remote service.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The skill forwards user-provided remote video URLs to the analysis service without any visible disclosure that external content will be submitted for remote processing. In this context, users may unknowingly cause sensitive or internal URLs to be shared with a third-party backend, creating privacy and potential internal-resource exposure risks depending on backend behavior.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The script accepts a hidden --api-key parameter and forwards it into analysis flow without visible disclosure to the user about credential usage, storage, or outbound transmission. In a skill context, hidden credential-bearing parameters reduce informed consent and can cause secrets to be passed into untrusted or unexpected remote services, especially when paired with opaque imported logic. The danger is heightened because the backend behavior is abstracted behind skill.get_output_analysis().

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The helper method performs an outbound HTTP POST to obtain a download URL, but the file provides no visible disclosure, consent flow, or indication to callers that user-supplied values may be transmitted over the network. In a skill advertised as call-content analysis, undisclosed network transmission increases privacy and trust risks, particularly if call-derived artifacts or identifiers are passed through these helpers.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The delete helper issues a remote HTTP POST for a deletion-style operation without any visible warning, confirmation, or disclosure. Even if intended as an internal wrapper, exposing a silent remote delete capability inside a narrowly scoped analysis skill increases the chance of misuse, surprising side effects, and unauthorized destructive operations.

Missing User Warnings

Medium

• Confidence: 75% confidence
• Finding: The loader silently creates configuration files and the saver silently writes them, while broad exception handling suppresses any errors. In an agent/skill context, undisclosed file-system modification can undermine operator expectations, mask misconfiguration, and potentially overwrite local state if paths are influenced elsewhere.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The function silently reads a sensitive identity value from data/smyx-api-key.txt and treats it as an internal identity source. This creates a privacy and security issue because the user is not clearly informed that a local secret/identity file will be consumed by the skill and potentially used for downstream authentication.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code automatically performs network authentication and account creation/registration via /sys/phoneLogin when tokens are missing. For a fraud-call analysis skill, silently creating or authenticating accounts without user disclosure is dangerous because it can establish external identities, transmit user-linked data, and trigger side effects outside the user's expectations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The general request helper injects user, tenant, platform, and skill-hub metadata into outbound requests and sends them to remote services without any visible user-facing notice in this code path. In a skill advertised for call-fraud identification, that hidden metadata transmission creates unnecessary privacy and compliance risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2