Outdoor Sports Event Risk Analysis Tool | 户外体育赛事风险分析工具

• Outcome: Review
• Latest audit: Aug 14, 2026 · 5:26 AM UTC
• Version: 1.0.10

Overview

This sports video analysis skill mostly matches its stated purpose, but it quietly creates and reuses user identity records, stores auth tokens locally, and sends sensitive media and identity-linked requests to remote services with limited user control.

Review before installing. Use this only if you are comfortable with uploaded sports videos, report history, and account-linked identifiers being processed by the LifeEmergence remote service, and with local workspace persistence of a generated user record and returned auth tokens. Avoid using sensitive participant footage unless you have consent and understand the service's retention and access policies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no explicit permissions while its documented behavior requires shell execution, local file reads/writes, network access, and likely environment use. This mismatch weakens reviewability and informed consent, because operators may not realize the skill can persist files locally and send user data to remote APIs.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document suddenly describes a smoking-detection surveillance capability inside a sports-risk-analysis skill, which is inconsistent with the stated purpose. Capability drift like this is dangerous because it can hide unrelated monitoring behavior, confuse reviewers, and cause the agent to invoke the skill in contexts involving broader surveillance than users expected.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill includes a `--list` mode that retrieves prior analysis records via `skill.get_output_analysis_list(open_id=open_id)`, which goes beyond the stated purpose of analyzing a provided video and returning a report. Because identity is derived from internal state (`ConstantEnum.CURRENT__OPEN_ID`) rather than explicit, visible user consent, this can expose historical analysis metadata or results for a user without clear disclosure or strict authorization boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This file exposes generic CRUD-style helpers and arbitrary HTTP wrappers that can send requests to caller-supplied URLs, which is much broader than the declared sports video safety-analysis purpose. In an agent-skill context, this expands the skill into a general network client and data-manipulation primitive, increasing the risk of unauthorized outbound requests, misuse of credentials/session context, or repurposing the skill for actions unrelated to its manifest.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The http_post/http_put/http_get/http_delete methods directly proxy arbitrary remote API calls to RequestUtil with a caller-controlled URL, giving the skill general outbound network capability without any visible restriction. In a skill whose stated purpose is sports-safety video analysis, this unjustified remote invocation surface can enable exfiltration, interaction with unintended services, or abuse of trusted runtime/network access if an attacker can influence inputs or call paths.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements persistent shared user-account CRUD, including identity and account lookup/update behavior, which is not justified by a sports video safety-analysis skill. In a least-privilege review, this creates an unnecessary capability to store and manipulate user account data, expanding attack surface and enabling unauthorized persistence or cross-context user data handling if the skill is invoked in environments where such data exists.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores personal identity data and authentication artifacts such as token and open_token, none of which are necessary for analyzing sports competition video risk. Retaining sensitive identity and token material in a local SQLite database materially increases the risk of credential theft, privacy violations, and misuse if the workspace, logs, backups, or the database file are exposed.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file exposes a generic `ai_chat` capability that can invoke an external agent, which is unrelated to the declared purpose of sports video safety analysis. This kind of capability expansion increases attack surface and enables arbitrary prompt-driven behavior inside a skill that users may trust for a narrow medical/sports-safety function.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The implementation does not perform the manifest-described sports video risk analysis; instead it centers on relaying prompts to an external agent. This mismatch is dangerous because it can conceal undeclared capabilities, weaken user trust boundaries, and permit broader actions than expected from a specialized safety-analysis skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This utility initializes, creates, and persists user identities unrelated to the declared sports video safety-analysis purpose. It can silently derive an identity from local files or create a default account-backed identifier, which expands the skill's authority and data handling beyond user expectations and the stated scope.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The HTTP helper performs external login/registration, loads cached tokens, injects authentication headers, and persists returned credentials. For a sports analysis skill, this is scope-expanding behavior that can transmit and maintain user-linked auth state without a clear, task-bound need, creating privacy and account abuse risk if misused or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code inspects workspace paths, environment variables, and local directories to determine agent context and where to read/write data. In isolation this is not inherently malicious, but in a narrowly scoped sports-analysis skill it increases environmental awareness and enables access to broader local state than users would reasonably expect.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The history-report trigger phrases are broad enough to match ordinary conversational requests, causing automatic cloud queries without clear user confirmation. In this skill, that is more dangerous because report history is linked to an internal identity and may expose prior sensitive health or event-analysis records unintentionally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells the agent to use a cloud API for history retrieval and analysis, but it does not clearly warn users that uploaded files, URLs, and derived risk-analysis data may be transmitted off-device. Because the content involves health and injury signals from sports participants, undisclosed remote processing creates meaningful privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that uploaded attachments and media are automatically saved as local files without notifying the user or describing retention and protection measures. Local persistence of sensitive video and health-related analysis inputs increases the risk of unintended disclosure, reuse, or later access by other processes or users.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code performs hidden internal identity handling through `OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))`, while suppressing `--open-id` from help output. Even if the current logic appears inconsistent, the pattern is dangerous because identity-affecting behavior is concealed from users, reducing transparency and increasing the risk of unauthorized data access or cross-user confusion when combined with listing/export features.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill reads arbitrary local files and uploads their full contents to an external analysis API, but this file contains no user-facing notice, confirmation step, or explicit consent mechanism before exfiltrating local data. In a skill that processes potentially sensitive videos of people and health events, silent upload increases privacy and data-handling risk if a user supplies a local file without understanding it will leave the host environment.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The CLI supports hidden internal parameters such as --api-key and performs remote video analysis via skill.get_output_analysis(), but the user-facing interface does not clearly disclose that potentially sensitive video data may be transmitted to an external service. In a sports-safety context, uploaded videos may contain identifiable participants and health-related observations, so the lack of explicit notice and consent creates a real privacy and security risk even if the behavior is functionally intended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code reads a credential-like identity value from data/smyx-api-key.txt and uses it as an internal identity source without any user-facing disclosure at the point of collection. Silent use of local credential material can surprise users, bypass informed consent, and increase the risk of unauthorized account linkage or data transmission.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This request path automatically attaches identity and authentication material such as X-Access-Token, X-Api-Key, Authorization, and pnaUserName to outbound requests. Transmitting those values without a clear user-facing warning is dangerous because it silently links activity to an account and increases the blast radius if endpoints, logs, or intermediaries are compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 95% confidence
• Finding: requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2