Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to perform cloud-based smoking-detection analysis, but it also silently creates or reuses identities, caches tokens, uploads sensitive media, and includes mismatched API documentation, so it should be reviewed before installation.
Install only if you are comfortable with local images/videos or submitted URLs being sent to the vendor's cloud service and with a workspace SQLite database retaining generated user identifiers and service tokens. Before approval, ask the publisher to document the exact data sent, retention/deletion behavior, authentication flow, report-history access controls, and to replace the mismatched pet-health API documentation.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
The skill reportedly performs user identity creation, local data persistence, workspace/environment detection, authenticated outbound HTTP requests, and token management, none of which are disclosed as the primary behavior in the manifest. Combined with the false smoking-detection framing, this can mislead operators into approving sensitive account and network actions they would otherwise scrutinize.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smoking-detection-analysis"
description: "Automatically detects smoking behavior in target areas based on computer vision; supports real-time detection of video streams, images, and video files; identifies violation smoking behavior and triggers violation alerts, assisting in smoking control safety management for parks/communities/units. | 公共场所吸烟行为智能检测技能，基于计算机视觉自动检测目标区域内的吸烟行为，支持视频流、图片、视频文件实时检测，识别违规吸烟行为，触发违规预警，助力园区/社区/单位控烟安全管理"
version: "1.0.18"
license:
This code creates and persists default user identities/open IDs and reads identity material from workspace files, which is unrelated to a smoking-detection computer vision skill. In context, that hidden identity bootstrap expands the skill's privilege scope and enables silent account linkage or impersonation behaviors without clear user consent.
The generic HTTP wrapper performs token discovery, remote login/registration, token caching, and authenticated requests to external platforms, capabilities well beyond the manifest's stated CV detection purpose. In a skill that should analyze images/video for smoking, hidden platform-auth and account-management logic increases the risk of covert data transmission and unauthorized service use.
The code can silently register or log into remote accounts using generated or reused identifiers, then obtain tokens for continued API access. That is dangerous because it enables account creation and authenticated platform interaction without an informed user action, which is unjustified for a local smoking-detection analysis skill.
The skill declares executable behavior that implies shell, network, filesystem, and environment access, but it does not explicitly constrain those capabilities with a tool scope or permissions block. In an agent setting, this increases the chance of over-privileged execution and makes review and enforcement harder, especially because the document instructs direct script execution and cloud access.
The default trigger is broad enough to activate on essentially any user-provided video, image URL, or file, which can cause unintended execution and data handling. In a skill with network and script execution behavior, overbroad triggers increase the chance of silent privilege use, accidental uploads, or processing of unrelated sensitive media.
The historical report query trigger relies on broad natural-language phrases and forces direct cloud API access, which can cause unintended retrieval of potentially sensitive report data. Automatic activation without clearer scoping raises privacy and authorization concerns, especially where reports may be tied to internal identities or prior analyses.
The file documents pet health analysis APIs, which materially contradicts the declared purpose of a smoking-detection skill. This kind of domain mismatch is dangerous because it can indicate copied or mispackaged components, causing the agent to call unintended backend services, expose unrelated data flows, or be deployed with incorrect trust assumptions.
The tool accepts a local file path or remote URL and invokes analyze_media(...), which delegates to skill.get_output_analysis(...) for external analysis, but the CLI only prints a generic progress message and does not clearly warn the user that media content and potentially associated identifiers may be transmitted to a backend service. For a surveillance-oriented smoking-detection skill, the uploaded content may contain sensitive imagery of people, locations, and operational metadata, so silent transmission creates a meaningful privacy and compliance risk even if the behavior is expected by the implementation.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
The skill reads arbitrary local files and uploads their full contents, or submits remote video URLs to an external analysis service, without any user-visible notice, consent prompt, or data-handling disclosure in this code path. In a vision-analysis context, uploaded media may contain sensitive imagery, location data, or personal information, so silent transfer to a backend materially increases privacy and compliance risk.
The manifest focuses on detecting smoking behavior and triggering alerts for submitted media. This method retrieves a paginated list of prior analysis reports and augments them with export-image URLs, which is report management/retrieval functionality beyond the stated detection behavior.
The manifest describes a skill dedicated to detecting smoking behavior in images, video streams, and video files, but this file exposes only generic 'video analysis' operations and a history-list feature without any smoking-specific logic, labels, or enforcement handling. The code delegates to broad methods like get_output_analysis and get_output_analysis_list, so the implemented behavior in this file is materially broader or less specific than the manifest claims.
The tool accepts a hidden --api-key parameter while suppressing help text, which reduces user visibility into credential handling. In a skill that communicates with external services, hidden credential pathways increase the risk of accidental exposure via process lists, shell history, wrapper logs, or undocumented integrations.
User-supplied local file paths or URLs are passed into remote analysis logic without clear disclosure that the content may be transmitted to an external service. In the context of video surveillance and smoking-detection for parks, communities, or units, this can expose sensitive imagery and location-related data, making silent upload behavior more privacy-impactful.
Detected: suspicious.install_untrusted_source