T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/config-dev.yaml:2- Finding
Sensitive surveillance media and credentials may be transmitted over plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Regional Humanoid Detection Skill | 区域人形检测技能
Security checks for vulnerabilities and agentic risk
Overview
This skill is a cloud video-analysis wrapper for human-detection reports, but it ships broad identity, token, history, and development-network behavior that users should review before installing.
Install only if you are comfortable with surveillance media and report history being processed by this vendor's cloud service. Before use, require production HTTPS endpoints, clear disclosure of uploaded data and retention, explicit consent for account association, and safer token storage; do not use this package as-is for sensitive workplace or restricted-area monitoring.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skills/smyx_common/scripts/util.py:548- Finding
Agent identity values are silently collected and submitted for remote registration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/smyx_common/scripts/dao.py:448- Finding
Reusable authentication tokens are stored unencrypted in a shared SQLite database
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (64)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
External API communication, authentication/token management, generated persistent user identifiers, and file/workspace access are all broader capabilities than advertised for a simple human-detection skill. Because the context involves monitoring people in restricted areas, undisclosed identity linkage and remote transmission make the privacy and security impact more severe than in a low-sensitivity domain.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: "human-detection-analysis" description: "Automatically detects personnel in target areas based on computer vision. Supports real-time video stream detection and is suitable for monitoring personnel access in parks, offices, and restricted areas. | 区域人形检测技能，基于计算机视觉自动检测目标区域内出现的人员，支持视频流实时检测，适用于园区、办公室、禁入区域等人员出入监测场景" version: "1.0.15" license: "MIT-0" --- # 🚶 Regional Humanoid Detection Skill | 区域人形检测技能 > **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · �
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file documents pet health analysis APIs while the skill metadata claims the skill performs human detection for monitored areas. This kind of capability mismatch is dangerous because it can hide the skill’s real behavior, mislead reviewers and operators, and cause the wrong backend service or data domain to be invoked under a deceptive description.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation does not merely contain an incidental mismatch; it actively specifies pet health analysis routes and scenario codes that contradict the declared human-detection purpose. In a security review context, this raises the risk of deceptive packaging, unauthorized data processing, or accidental connection to unrelated services handling different sensitive data.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This utility module for a human-detection skill contains substantial unrelated identity resolution, token persistence, workspace discovery, user lookup, auto-login/registration, and authenticated API request logic. That scope mismatch is dangerous because it quietly grants the skill account-management and outbound network capabilities unrelated to computer vision, increasing the chance of undisclosed data handling, account misuse, and supply-chain style abuse.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code can silently call an external /sys/phoneLogin endpoint with register=1 and identity fields derived from local state, effectively auto-registering or logging in users without an explicit user action in this file. In the context of a personnel-detection skill, that behavior is unjustified and creates risk of unauthorized account creation, identity misuse, and transmission of user-linked data to external infrastructure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries even though the manifest instructs behavior that implies shell execution, network access, local file handling, environment/config use, and report retrieval. In an agent setting, missing scope declarations increase the chance of over-privileged execution, unexpected data access, and unsafe handling of local files or external URLs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill accepts local files and network URLs and appears to send them to external/cloud services, yet the description does not clearly warn users that their surveillance data and report queries leave the local environment. For a monitoring skill involving videos of people and restricted areas, lack of disclosure materially increases privacy, compliance, and consent risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger conditions are broad enough to cause automatic invocation on common phrases like report/history queries or generic references to detection, increasing the chance of unintended file handling or cloud API access. In this skill's context, accidental invocation is more serious because it may process surveillance media or fetch account-linked historical reports without sufficiently explicit user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains numerous natural-language messages, CLI descriptions, and error texts exclusively in Chinese, such as the argparse description and printed status/error messages. Because the skill does not offer user language selection or document that it is intentionally restricted to a Chinese-speaking context, it violates the language/locale policy requirement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file includes capabilities to list prior analyses and construct export URLs, which go beyond the manifest description of performing human detection on input video. Hidden or undocumented functionality increases the risk of data exposure because users or calling systems may invoke access to historical results or exported details without realizing the skill has those privileges.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script resolves an internal OpenID identity even though the advertised function is video-based human detection, creating unnecessary coupling to identity data. This expands the data-access scope of the skill and can enable tracking, correlation, or unauthorized access to user-specific analysis records if the identity is resolved implicitly without a clear user need or consent.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Static analysis
Detected: suspicious.install_untrusted_source
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- skills/smyx_common/scripts/config-dev.yaml:2