T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/util.py:410- Finding
Workspace API-Key File Is Reused and Transmitted as User Identity
- Content
View full analysis
- Remediation
View remediation
Security audit
test
Security checks for vulnerabilities and agentic risk
Overview
The skill provides video search through a cloud analysis service, but it silently creates or reuses a remote identity and stores/transmits sensitive account data in ways users may not expect.
Install only if you are comfortable sending videos, video URLs, report metadata, and an automatically managed identity to the lifeemergence.com service. Do not keep real API keys in `data/smyx-api-key.txt`, and treat the workspace `data` directory as sensitive because it may contain reusable service tokens and report-linked identifiers.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/util.py:568- Finding
Authentication Credentials Are Attached to Arbitrary Absolute URLs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/smyx_common/scripts/dao.py:174- Finding
Reusable Authentication Tokens Are Stored in Plaintext SQLite
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/smyx_common/scripts/config.py:146- Finding
HTTP Wire Debugging Is Unconditionally Enabled on Windows
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (56)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes a broad set of hidden behaviors: filesystem access, persistent identity generation, local user storage, remote authentication, outbound API requests, and billing/account handling. In the context of a skill for analyzing potentially sensitive video, undisclosed identity binding and external service interaction materially increase privacy, authorization, and data-exfiltration risk.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: "video-search-analysis" description: "Conducts intelligent video search based on target and semantic descriptions; supports conventional target retrieval, natural language description retrieval, and vectorized model matching. | 视频搜索/视频检索智能分析技能，基于目标、语义描述进行智能视频搜索，支持常规目标检索、自然语言描述检索、向量化模型匹配" version: "1.0.5" license: "MIT-0" --- # 🔎 Intelligent Video Search & Retrieval Analysis Skill | 视频搜索检索智能分析技能 > **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implementation performs media upload, asynchronous analysis polling, report retrieval, and report export rather than video search or retrieval as declared in the metadata. This capability mismatch is dangerous because users and policy layers may grant the skill access under the assumption of search-only behavior, while the code actually transmits content to a backend analysis service and exposes derived report URLs.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The HTTP helper automatically logs in or registers users remotely, injects identity fields into outbound requests, retries authorization, and stores returned tokens locally. That behavior is beyond normal video-search functionality and creates a covert authentication and account-bootstrap channel, which is especially risky in an agent skill that may be invoked without the user understanding that identities and tokens are being established and reused.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill manifest describes behavior that requires powerful capabilities including shell execution, network access, and local file read/write, but it does not declare any explicit tool scope or permission boundaries. This creates a least-privilege failure: a caller or platform may permit broader execution than users expect, increasing the blast radius if the skill is abused or compromised.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The default trigger says the skill should automatically activate whenever a user needs to search for specific content in video, which is overly broad for a capability that can save files locally and invoke remote APIs. Broad triggers increase the chance of unintentional activation, causing videos or URLs to be processed, stored, or transmitted without sufficiently explicit user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The history-report trigger list includes broad natural phrases that could be mentioned conversationally, yet it causes automatic cloud API queries for prior reports. Because those reports may be identity-linked and sensitive, ambiguous activation raises privacy and authorization concerns and may reveal more data than the user intended to request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill states that uploaded attachments or video/image files are automatically saved as local files, but the description does not present this as an explicit user warning or consent boundary. Automatic local persistence of potentially sensitive media is dangerous because it increases residual data exposure on the host, especially for surveillance footage or personal media.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing string on L17 is hardcoded in Chinese, which imposes a specific language/locale choice. The file does not indicate any user opt-in, language selection mechanism, or documented reason for restricting output to Chinese.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes the skill as supporting retrieval based on semantic or natural-language descriptions, which implies a text-driven search mode. However, the main entrypoint exits unless --input or --url is supplied, so a description-only search is not actually available through this code path.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
python result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text) result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json, dict) else result_json if result_json_common_ai_response: result_json = result_json_common_ai_response
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Several user-visible strings are fixed in Chinese, including report headings and error/status messages, with no option for the user to choose locale. This can violate language/locale policy when the skill forces a specific language without explicit opt-in or documented regional scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
When a local path is provided, the code reads the entire file and sends it as multipart upload to the analysis backend, but this file contains no user-facing disclosure, consent check, or confirmation step before transmission. In a skill context, silent upload of local media can expose sensitive video contents to external services and violate user expectations created by the manifest.
- Content