ClawHub
Back to skill

Security audit

Intelligent Public Smoking Detection Skill | 公共场所吸烟行为智能检测技能

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches smoking detection, but it silently creates or reuses cloud identity, uploads media, queries history, and stores tokens locally with limited user control.

Install only if you are comfortable with smoking-detection media being sent to a cloud service, automatic report-history lookup, silent account or identity association, and local storage of tokens/profile data in the workspace. Operators should require clearer consent, retention, endpoint, and credential-handling documentation before broad deployment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
80% confidence
Finding
This code uses unvalidated keys from the filters dict to dynamically access model attributes. While SQLAlchemy prevents classic SQL injection here, an attacker who can control filter keys may trigger access to unintended model attributes, cause exceptions for invalid names, or bypass intended query restrictions by querying on sensitive fields the caller should not control.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
80% confidence
Finding
As in list(), this count() method accepts arbitrary filter keys and resolves them dynamically against the model. If untrusted input reaches this method, it can enable unauthorized querying of internal fields or cause predictable application errors that aid probing and enumeration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs the agent to read and write local files, invoke shell commands, access environment-derived identity, and make network calls, yet it declares no permissions or trust boundaries. This creates a capability-transparency gap: operators and policy systems cannot accurately assess or constrain what the skill will do before execution.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The API documentation describes a different product domain (pet health analysis) than the declared smoking-detection skill. This mismatch is dangerous because it can cause the agent or integrators to call unrelated endpoints, expose data to the wrong backend, or indicate copied/repurposed skill content that has not been security-validated for the stated use case. In a security review, such cross-domain inconsistency is a strong sign of configuration drift or supply-chain hygiene issues.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill exposes a user-specific analysis history listing function via `show_analyze_list(open_id)` even though the manifest describes only smoking detection on supplied media. This expands the data-access surface from single-request inference to historical record retrieval, which can expose prior analyses and associated metadata if access control is weak or the caller identity is ambiguous.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code silently resolves an internal user identity with `OpenIdUtil.resolve_current_open_id(...)` despite the skill being presented as a media-analysis tool. Undisclosed identity binding can enable tracking, attribution of analyses to a user account, and access to user-scoped data without clear consent or transparency.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This service exposes broad generic HTTP and CRUD wrapper capabilities that are not constrained to smoking-detection operations. In a skill whose declared purpose is computer-vision smoking detection, this creates unnecessary attack surface and can enable unintended access to arbitrary backend actions if higher-level callers pass attacker-controlled URLs or parameters.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The get_user_by_username capability performs account lookup unrelated to the advertised smoking-detection function, indicating hidden or over-privileged functionality. Such user-enumeration or account-resolution features can expose internal identity data and be abused for reconnaissance, especially when bundled into an unrelated skill.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This utility code can derive or create a user identity, auto-register/login against a remote service, and persist tokens locally, which is far beyond the stated purpose of a smoking-detection analysis skill. In a security review, this creates unjustified identity coupling and silent account activity that could expose user identity, consume account resources, or bind the skill to backend services without informed consent.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The file implements a broad-purpose authenticated HTTP client with token management, retry logic, tenant/platform injection, and arbitrary URL handling, which exceeds the narrow manifest description of smoking detection. That mismatch increases risk because the skill can act as a general backend-access bridge and transmit data to external services unrelated to the advertised function.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The history-report trigger phrases are broad enough to activate on generic requests such as viewing reports or history, which can cause the skill to retrieve cloud-hosted historical data when the user did not clearly intend this specific action. In a surveillance/reporting context, over-triggering can expose sensitive prior analyses or metadata without sufficiently specific user intent.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill states that uploaded images/videos are automatically saved locally, but it does not provide a clear user-facing notice about storage location, retention, access controls, or deletion. Media files may contain sensitive surveillance footage or personal data, so silent local persistence increases privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill mandates direct cloud API queries for historical reports and explicitly forbids alternative local sources, but it does not clearly warn users that requests will retrieve potentially sensitive data from a remote service. In a monitoring/compliance setting, remote access to historical reports can expose personal or operational data if users are not informed and access is not tightly scoped.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Resolving sensitive internal identity without any user-facing disclosure is a privacy and transparency issue. In this context, a smoking-detection tool may process compliance-related media, so hidden identity association increases the risk of undisclosed monitoring, audit trails, and linkage of potentially sensitive workplace/community enforcement data to individuals.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code reads arbitrary local file contents and sends them to the remote analysis API, but this file does not provide any user-facing notice, confirmation, or consent check before exfiltrating the data. In a skill that processes videos and images from local paths, this creates a real privacy and data-handling risk if users do not realize local content is uploaded off-host for analysis.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The User model persists sensitive personal data and tokens (username, realname, email, birthday, token, open_token) in a local SQLite database without any protection visible in this file, such as encryption, minimization, retention controls, or masking. If the workspace or database file is exposed, attackers could obtain credentials or personal data, making this particularly concerning in an agent skill that may run on shared infrastructure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Enabling HTTPConnection and urllib3 debug logging can expose full request and response contents, including tokens, identifiers, and possibly image/video-derived metadata, especially in shared logs. Even if only active in debug mode, there is no user-facing warning or redaction guarantee, so sensitive data may be leaked during troubleshooting or misconfiguration.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads an identity-like value from a workspace file named smyx-api-key.txt and reuses it as an internal open-id without any disclosure or consent flow. In this skill context, silently harvesting a credential-like local identifier is unrelated to smoking detection and can result in unauthorized identity reuse or confusing cross-skill account linkage.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
91% confidence
Finding
This code transmits an openId/mobile/source payload to an external health service endpoint to create or retrieve a user account. External transmission alone is not always a flaw, but here it is security-relevant because the transfer supports silent identity provisioning unrelated to the advertised smoking-detection purpose and may send locally derived identifiers off-host.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：视频支持 mp4/avi/mov 格式，图片支持 jpg/png/jpeg 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供控烟管理参考，具体处置请按单位相关规定执行 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📁 格式支持 | 当显示历史检测报告清单的时候，从数据 json 中提取字段  作为超链接地址，使用 Markdown 表格格式输出，包含" |
Confidence
86% confidence
Finding
The malformed/truncated table entry and hidden-character indicator suggest concealed or incomplete instructions around extracting fields from report JSON and rendering links. Hidden or obfuscated content in a skill manifest is dangerous because it can alter agent behavior in ways not visible to reviewers, especially when combined with remote data retrieval and report generation.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smoking-detection-analysis"
description: "Automatically detects smoking behavior in target areas based on computer vision; supports real-time detection of video streams, images, and video files; identifies violation smoking behavior and triggers violation alerts, assisting in smoking control safety management for parks/communities/units. | 公共场所吸烟行为智能检测技能，基于计算机视觉自动检测目标区域内的吸烟行为，支持视频流、图片、视频文件实时检测，识别违规吸烟行为，触发违规预警，助力园区/社区/单位控烟安全管理"
version: "1.0.15"
license: "MIT-0"
---
Confidence
78% confidence
Finding
The YARA hit for metadata/tool poisoning, together with the hidden-character evidence elsewhere, indicates the manifest may contain poisoned or misleading metadata that influences tool selection or agent behavior. In agent skill ecosystems, metadata poisoning is dangerous because agents often trust manifest fields to decide when to invoke a skill and what authority it needs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2