Kitchen Stove Left-On Detection | 老年人厨房忘关火识别

• Outcome: Review
• Latest audit: Aug 30, 2026 · 12:09 PM UTC
• Version: 1.0.9

Overview

This skill does kitchen video analysis as advertised, but it also silently creates or reuses persistent user identity and token state while sending sensitive home video and identifiers to remote services.

Install only if you are comfortable with kitchen camera footage or video URLs being processed by remote services and with the skill creating or reusing a persistent identity in local workspace data. Confirm the backend endpoints, token storage, report retention, consent process, and any gas-valve automation controls before use, especially in homes or care settings.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 84% confidence
• Finding: Here, getattr(self.__model__, key) uses keys from the caller-supplied filters dictionary, so an untrusted caller can influence which model attributes are resolved. While SQLAlchemy still parameterizes values and this is not classic SQL injection, it can enable unauthorized querying on unintended columns, trigger exceptions for invalid attributes, and weaken data-access boundaries in a shared DAO used across skills.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 83% confidence
• Finding: This count() path has the same issue as list(): it resolves model attributes from untrusted filter keys without validation. In a shared data layer, that can expose metadata about records on sensitive fields, allow unintended enumeration, or cause controllable errors that aid probing of the schema.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises substantial capabilities—shell execution, network access, environment access, and file read/write—without declaring permissions or exposing those expectations clearly. This reduces transparency and weakens policy enforcement, making it easier for a user or platform to invoke code that accesses local data or external services unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose suggests local fixed-camera safety monitoring, but the actual behavior includes uploading video and metadata to remote APIs, handling arbitrary URLs/files, querying backend history, and creating persistent identities/tokens. This mismatch is dangerous because users may consent to a narrow safety-analysis use case while the skill performs broader data collection, external transmission, and persistent account linkage involving sensitive in-home video.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The code comment states that internal user identity is initialized without requiring user input and hidden from help, but the implementation still accepts a caller-supplied --open-id and passes it to OpenIdUtil.resolve_current_open_id(). If downstream data access is scoped by open_id, an attacker may enumerate or access another user's analysis history or perform actions under another identity.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them for analysis, which expands behavior beyond the stated fixed-camera local monitoring use case. This can enable privacy-invasive analysis of unrelated third-party content and may also cause backend systems to fetch attacker-controlled URLs, increasing abuse and data-governance risk.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The report listing/history function exposes broader analysis-record retrieval capability that is not described in the stove-monitoring manifest. If surfaced to users or other components without authorization checks, it can reveal prior analysis metadata or outputs beyond the expected single-purpose alerting workflow.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file exposes broad generic network and CRUD wrappers (`add`, `edit`, `delete`, `http_get`, `http_post`, `http_put`, `http_delete`) that are not constrained to the stove-monitoring purpose described in the manifest. In a skill expected to analyze kitchen camera input and optionally trigger alerts or valve shutdown, arbitrary API access materially expands the skill's capability surface and could enable unauthorized data access, command execution against backend services, or hidden secondary behaviors if other components invoke these helpers with attacker-controlled endpoints or payloads.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The `get_user_by_username` helper introduces identity lookup capability that is not justified by the stated stove-left-on detection workflow. Even if intended for notifications, exposing direct username-based lookup increases the chance of unnecessary user enumeration or access to account information beyond what is needed for a safety-monitoring skill.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This file includes generic user-account persistence and mutation logic in a skill whose declared purpose is stove-left-on video detection. The mismatch increases the attack surface and creates unjustified capability to read, create, update, and delete user records in a context that should not need account management.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The User model stores and updates authentication-related fields such as token and open_token, which are not justified by the skill's stated camera-based safety function. Retaining credential material in a broadly reusable local DAO materially raises the impact of compromise by enabling account takeover, token leakage, or cross-skill abuse.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill metadata describes a narrowly scoped stove-left-on video analysis capability, but this file exposes a generic `ai_chat` interface that can relay arbitrary prompts to an external agent service. That mismatch expands the skill's effective privilege and behavior surface, enabling repurposing beyond the declared safety function and undermining user and platform trust boundaries.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The utility code creates or recovers persistent user identities, reads an open-id from local workspace data, and writes default identities into a local database. That capability is unrelated to the stated stove-monitoring function and silently establishes durable user identity state that can later be used for network authentication and attribution. In a camera-monitoring skill, this scope expansion is especially concerning because it couples a safety function with hidden account lifecycle behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The HTTP wrapper silently performs login/registration, loads tokens from local storage, retries authorization, and attaches authentication headers to outbound requests. This is a broad remote-account and credential-management subsystem embedded in a utility file for a stove-left-on detection skill, far beyond the declared functionality. Because the skill also handles home/kitchen monitoring context, hidden outbound authenticated communication materially increases privacy and abuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code inspects workspace layout, agent identity, environment variables, and creates data/skills directories dynamically. While not inherently malicious, these filesystem and environment-discovery capabilities are not justified by simple video analysis and increase the skill's ability to persist state and interact with broader agent infrastructure. In an over-scoped utility module, this expands the blast radius if the skill is modified or abused.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default trigger activates on broadly described kitchen video analysis requests, which can cause the skill to run in situations the user did not specifically intend. Because this skill may upload video externally and could recommend or trigger gas-valve actions, over-broad activation increases the chance of privacy-invasive processing or unsafe automation from ambiguous prompts.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The keyword trigger list includes many broad household-safety and report-related terms without strong scope constraints, so normal conversation or unrelated uploads could invoke the skill automatically. In this context, accidental activation is more dangerous because the content involves sensitive home surveillance footage and possible downstream safety actions or notifications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill mentions interoperability with automatic gas-valve shutdown but does not clearly foreground that this is a disruptive physical-world action with safety implications. In a home-care setting, false positives or misunderstood automation could interrupt cooking, affect vulnerable users, or cause unsafe behaviors if shutdown occurs unexpectedly.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Remote video URLs are submitted for analysis without any user-facing warning, consent flow, or disclosure in this code path. For a kitchen-monitoring skill processing sensitive in-home video, silent transmission of remote content increases privacy and compliance risk because users may not understand what is being sent or analyzed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code reads full local video file contents into memory and uploads them for analysis without any user-facing disclosure in this file. Because the skill handles indoor kitchen footage, undisclosed upload of local recordings can expose highly sensitive household activity and create privacy, retention, and compliance concerns.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code reads sensitive identity material from data/smyx-api-key.txt and uses it as an internal identity source without any evident user-facing disclosure. Even if intended for convenience, silently consuming credential-like data from workspace storage can surprise users and enable unauthorized account linkage or outbound actions under an implicit identity. In a household safety camera skill, undisclosed identity binding is more dangerous because users expect local safety automation, not hidden credential reuse.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request flow automatically assembles and transmits user identifiers and authentication headers, including pnaUserName, X-Access-Token, X-Api-Key, and Authorization, without any visible user disclosure at the point of use. This creates a covert data-sharing path and can bind home-monitoring activity to persistent identity and remote services. Given the declared purpose is stove safety detection, this hidden transmission is disproportionate and privacy-impacting.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 93% confidence
• Finding: The code performs an external POST to a health service login endpoint with openId, mobile, and source fields to create or retrieve a user account. External transmission is not inherently unsafe, but here it occurs as part of silent account provisioning that is unrelated to the manifest's stove-left-on detection purpose. That makes the transmission privacy-sensitive and potentially unauthorized in context.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2