Back to skill

Security audit

Image Quality Assessment Analysis Tool | 图像质量检测分析工具

Security checks across malware telemetry and agentic risk

Overview

The skill performs image-quality analysis through a remote service, but it also automatically creates or reuses identities, persists tokens locally, and queries account-linked history with limited user control.

Install only if you are comfortable with camera images or videos being sent to the configured cloud service and with the skill automatically managing an identity, reading data/smyx-api-key.txt when present, creating a local SQLite user database, and storing returned tokens for report history access. Review the endpoint configuration before use, especially because the included config selects a dev environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no permissions while its documented behavior clearly implies shell execution, network access, local file reads/writes, and possible environment use. This is dangerous because it prevents meaningful user or platform consent and hides the real trust boundary of the skill, especially when it saves uploads locally and calls remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is image-quality detection, but the skill also appears to manage local identities, persist tokens, auto-register/login users through a remote service, and enumerate historical reports. That is a substantial scope expansion beyond the declared function and is dangerous because users may unknowingly trigger account creation, authentication, persistence of credentials, and cloud data access unrelated to simple media analysis.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill exposes report-listing and export-link generation capabilities that are not described in the manifest, increasing the effective privilege and data exposure surface of the skill. If invoked by an agent or user who only expects one-off quality analysis, this can reveal prior analysis metadata or downloadable report artifacts without clear consent or expectation.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
The history-listing capability expands the skill beyond its declared purpose and may expose prior analysis records tied to an open_id. In a surveillance or camera-analysis context, historical records can contain sensitive metadata or results, so an undocumented listing feature increases the risk of unauthorized data access or over-collection.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file implements a generic API wrapper with pagination, CRUD helpers, and arbitrary HTTP method passthroughs that are not constrained to image-quality detection operations. In the context of a narrowly declared surveillance image-quality analysis skill, this broad network capability significantly expands the attack surface and could be reused to access or manipulate unrelated backend services if exposed through the skill.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The add, edit, and delete methods provide remote state-changing capabilities without any visible restriction, purpose limitation, or safety checks. For a skill whose stated purpose is passive image-quality detection, exposing modification and deletion primitives is unnecessary and dangerous because it enables unintended or unauthorized changes to backend resources.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The http_post, http_put, http_get, and http_delete methods expose arbitrary outbound HTTP functionality through a thin wrapper, with no visible destination restrictions or protocol-level safeguards. Even if intended as a utility, this is overly broad for an image-quality detection skill and could be abused as a general network access primitive against internal or external services.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The presence of a generic user/account SQLite DAO in an image-quality detection skill is a strong scope mismatch and expands the attack surface with unnecessary identity-management capabilities. Unjustified data persistence logic enables collection, mutation, and correlation of user records in a context where such functionality is not needed, making any compromise more damaging and suspicious.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code stores and mutates usernames, real names, email addresses, tokens, and open tokens despite the skill being described as an image-quality analysis tool. Such unjustified handling of identity and credential-like data materially increases privacy and secret-exposure risk, and the mismatch with the skill context makes the behavior more suspicious and dangerous.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The utility module contains identity resolution, default user generation, credential-file reading, and local user persistence that are unrelated to image quality detection. In the context of an image-analysis skill, this is dangerous because it silently provisions and reuses identities, expanding data collection and account linkage beyond what users would reasonably expect.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The HTTP wrapper does more than transport requests: it performs token recovery, automatic login/registration, credential header injection, retry behavior, and account-state handling. For a camera image-quality skill, this broad external account/authentication behavior is out of scope and creates hidden network side effects that can transmit user identifiers and tokens to remote services.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code reads a workspace file named smyx-api-key.txt and falls back to maintaining local user database state to derive an open-id. This is risky because it accesses sensitive identity material and persists user state without clear relevance to image quality analysis or visible user disclosure.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The agent workspace discovery logic enumerates environment variables, inspects filesystem paths, and creates data/skills directories. In a skill advertised for image-quality detection, this expands its filesystem reach and can facilitate persistence or access to unrelated workspace content beyond what is needed for local image inspection.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The history-report trigger phrases are broad enough to match ordinary conversation about reports, causing automatic cloud queries without clear intent confirmation. In this skill context, that can expose remote report metadata or initiate unintended data retrieval tied to an internal identity association.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill states that uploaded attachments are automatically saved as local files, but it provides no user-facing warning or retention policy. This is dangerous because surveillance images and video may contain sensitive data, and silent local persistence increases privacy, leakage, and forensic exposure risks.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation requires cloud API access for history-report queries but does not warn users that their request results in remote data retrieval. This is dangerous because it obscures cross-boundary data access and may reveal report metadata, account-linked history, or URLs from a remote service without informed consent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads the entire local file and uploads it to the analysis service without any user-facing warning or confirmation in this file. That creates a clear data-transfer risk because local surveillance footage or other sensitive media may be sent off-box to a remote service unexpectedly.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The delete helper directly issues an HTTP POST to a caller-supplied URL with no visible user disclosure, confirmation, or guardrails around destructive behavior. In an analysis-oriented skill, hidden destructive capability is especially risky because consumers would not reasonably expect resource deletion as part of image-quality inspection.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill reads a sensitive credential/identity file from the workspace without any user-facing warning, consent, or clear necessity for the declared purpose. Hidden access to credential material undermines transparency and can surprise users who only intended to run an image-quality check.

Missing User Warnings

High
Confidence
98% confidence
Finding
The code automatically sends identity data such as openId and mobile to a remote /sys/phoneLogin endpoint with register=1 and silent=1, meaning login/registration can occur without explicit user awareness. This is especially dangerous in an image-analysis skill because users would not reasonably expect remote account creation or identity transmission as a side effect of using camera-quality tooling.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2