Workplace Phone Usage Smart Monitoring Skill | 职场玩手机智能监测技能

• Outcome: Review
• Latest audit: Aug 25, 2026 · 9:54 PM UTC
• Version: 1.0.10

Overview

The skill is a workplace surveillance analyzer, but it also silently creates or reuses account identity, stores tokens locally, and sends media plus identifiers to under-disclosed cloud or dev endpoints.

Review before installing. Use only if you have lawful authority and employee notice/consent for monitoring, and verify the service endpoint, transport security, retention policy, account creation behavior, and local token storage. The artifact should be tightened to require explicit consent for history lookup and identity provisioning.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read local files, write outputs, access the network, use environment-backed identity handling, and execute shell commands, but it declares no corresponding permissions or trust boundaries. This mismatch can cause the platform or user to underestimate the skill's real capabilities, increasing the risk of unexpected data access, command execution, or exfiltration during use.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is described as a media-analysis tool, but it also exposes a history-listing function keyed by an internal user identity. That creates an unexpected data-access surface: a caller can retrieve prior analysis records unrelated to the immediate file/URL they provided, which increases privacy risk and violates least surprise for a surveillance-oriented employee monitoring tool.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code silently resolves an internal OpenID/user identity even though the primary function is file/URL analysis. Hidden identity initialization can bind requests to an internal account and enable access to account-scoped data or operations without explicit user awareness, which is especially risky in an employee surveillance context handling sensitive behavioral records.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The file exposes generic network primitives (`http_post`, `http_put`, `http_get`, `http_delete`) that can send requests to arbitrary caller-supplied URLs, which is broader than the declared phone-usage monitoring purpose. In an agent skill context, this creates an unnecessary capability surface for data exfiltration, internal network access, or abuse as a proxy if other parts of the skill or upstream inputs can influence the URL or payload.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: The `get_user_by_username` helper introduces an account lookup capability unrelated to computer-vision detection of phone usage, expanding the skill’s access to identity data without clear justification. While not inherently exploitable on its own, unnecessary user-enumeration functionality can aid privacy violations, reconnaissance, or unauthorized correlation of monitoring results with user identities.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This file defines generic user-account persistence functionality that is unrelated to the stated phone-usage monitoring purpose, expanding the skill's data-handling scope without clear necessity. Unjustified identity/account management increases the chance of privacy misuse, unauthorized retention, and lateral reuse of personal records beyond the declared function of the skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The User model stores identity and authentication-related data such as username, realname, email, token, and open_token, which is difficult to justify for a computer-vision phone-usage monitoring skill. Persisting such sensitive data without clear purpose or safeguards materially increases privacy and credential exposure risk if the local SQLite database is accessed, copied, or reused by other components.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file for a phone-usage computer-vision skill contains generic LLM chat/session orchestration that is unrelated to the declared purpose. Hidden or unnecessary AI-agent functionality increases attack surface, can enable unintended data flow or prompt handling, and makes it harder to reason about what the skill actually does.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring states that the method invokes an external agent via subprocess, but the implementation does not do so and instead uses a dummy result object shape incorrectly. This mismatch is dangerous because security reviewers and downstream code may trust behavior that is not real, masking dead code, incomplete integrations, or later-swapped execution paths that receive less scrutiny.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs authenticated API access, token handling, identity resolution, and remote account bootstrap behavior that is not justified by a phone-usage monitoring skill. This creates a hidden data flow and capability expansion: installing or invoking the skill may silently interact with external services using local identities and persisted tokens, increasing the risk of covert tracking, account misuse, or unintended exfiltration.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can call a remote /sys/phoneLogin endpoint with register=1 and silent=1, using a locally derived username/openId/mobile value to create or provision an account automatically. Silent identity creation unrelated to the stated skill purpose is dangerous because it can bind local user identifiers to a remote service without informed consent and establish reusable credentials for later access.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This code reads identity material from workspace state and local storage, creates default open-id values, and persists them for reuse, despite those behaviors being unrelated to analyzing employee phone usage from images or video. Persisting identity state expands tracking and authentication scope, enabling cross-session linkage and later remote use without the user's awareness.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger rules are broad enough to auto-activate on general employee-monitoring or workplace-analysis requests, including keyword-based matches for historical report access. Overbroad activation can lead to unintended surveillance processing, accidental access to sensitive monitoring records, or execution of privacy-invasive workflows without sufficiently specific user intent.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: This skill is designed to analyze surveillance images, videos, and URLs for employee behavior, yet it does not present a prominent upfront warning about privacy, consent, retention, and legal restrictions. In this context, missing privacy disclosure is especially dangerous because the workflow involves monitoring identifiable workers and generating behavior reports that may be sensitive or regulated.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill reads local files or forwards remote video URLs to an external analysis service without any visible consent notice, privacy warning, or destination transparency in this code. Because the skill's stated purpose involves employee surveillance video, silent transmission can expose sensitive personal data and workplace footage to external systems, increasing privacy, compliance, and data-handling risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code prioritizes environment-derived workspace context and uses it to determine agent identity and storage locations, which can affect how identity data is resolved and reused without any user-facing notice. In this broader file, that context feeds later identity and token handling, so hidden environment-derived state materially influences sensitive behavior.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The function reads an identity value from data/smyx-api-key.txt and treats it as an internal identity/open-id source with no visible disclosure or consent. Hidden local identity harvesting is risky because it enables silent account association and downstream authenticated requests that users would not reasonably expect from a phone-monitoring skill.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The network request sends identity-linked fields such as openId and mobile to a remote endpoint, and the broader request logic also attaches access tokens and authorization headers, all without general user-facing disclosure. This is dangerous because it creates undisclosed transmission of identifiers and credentials to external services unrelated to the visible monitoring function.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: This requests.post call transmits locally derived identity data to an external service. External transmission alone is not always vulnerable, but here it is coupled with silent registration/login behavior and lacks any clear relationship to the skill's stated computer-vision purpose, making the data flow security-relevant.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2