Intelligent Video Search & Retrieval Analysis Skill | 视频搜索检索智能分析技能

• Outcome: Review
• Latest audit: Jul 7, 2026 · 11:29 PM UTC
• Version: 1.0.6

Overview

This skill appears to perform video search, but it also silently creates or reuses cloud-linked identities and stores tokens locally, so it needs review before installation.

Install only if you are comfortable with your videos or video URLs being sent to the listed cloud service, and with the skill creating or reusing an identity, logging in/registering silently, and storing tokens in a local workspace database. Review endpoint ownership, retention/deletion expectations, and whether the automatic history-report and identity behavior matches your workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (21)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 80% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill manifest advertises no explicit permissions while the documented workflow directs execution of local Python scripts that can read/write files, access environment state, invoke shell commands, and perform network requests. This under-declaration prevents informed consent and weakens sandbox/policy enforcement, especially because the skill also handles uploaded files and remote URLs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is narrow video search/retrieval, but the documented behavior extends to historical report enumeration, report-link generation, persistent local identity creation, and remote authentication/token storage. This mismatch is dangerous because users may provide media under the assumption of a single-purpose retrieval tool while the skill performs additional stateful and networked operations that affect privacy and account scope.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The file defines a persistent local user/account store with usernames, real names, email addresses, birthdays, and tokens, which is unrelated to the declared video-search capability. Unnecessary identity and token storage expands the attack surface and increases the risk of unauthorized data retention, cross-skill data exposure, or privacy violations if the shared database is accessed by other components.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The DAO automatically creates and alters a shared SQLite database under a workspace-wide data directory, which exceeds a narrow video-search role and can affect other agents or skills sharing that workspace. Automatic schema mutation in shared state increases the blast radius of bugs, can cause unintended coupling between components, and may enable cross-skill data access or corruption.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The utility code reads a workspace identity file and can create and persist synthetic default user identities locally, which is unrelated to the advertised video-search functionality. This expands the skill's access to sensitive workspace state and silently establishes identity material that may be reused for later authenticated operations without clear user consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code automatically calls a health-service login/registration endpoint with openId/mobile values and registration enabled, despite this skill being presented as a video-search capability. That creates an undisclosed account creation and authentication side effect, and transmits identity-linked data to an external service without necessity tied to the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The request helper contains recharge/payment workflow messaging that is unrelated to video retrieval, indicating the skill bundle includes broader monetization logic than declared. This kind of capability mismatch is dangerous because it can mislead operators about what side effects the skill may trigger and can normalize unexpected account-directed flows.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default trigger is broad enough to activate on many ordinary requests about finding content in videos, increasing the chance that attachments are auto-saved and remote analysis is initiated without a deliberate opt-in. In a skill that can persist files and contact cloud services, over-broad invocation materially raises privacy and unintended-execution risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that uploaded attachments are automatically saved as local files, but the description does not present this as a prominent user warning or consent checkpoint. Silent local persistence can expose sensitive media to later reuse, backup, or unintended access on the host system.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow encourages passing network URLs and says the API service will automatically download remote resources, but does not clearly warn users that content will be fetched server-side. This creates privacy and SSRF-like risk surfaces because arbitrary URLs may cause the remote service to access resources outside the user's expectation.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The tool performs internal identity resolution through a hidden --open-id parameter without user-facing disclosure, which can create confused-deputy or impersonation risks if callers can supply another user's identifier. In a video search/listing skill, identity directly affects which analysis records are retrieved, so undisclosed identity switching increases the chance of unauthorized data access if downstream validation is weak or absent.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code uploads either a local video file's full contents or a user-supplied remote video URL to analysis APIs without any user-facing notice, consent flow, or visible trust boundary in this file. This creates a privacy and data-handling risk because potentially sensitive media or internal URLs may be transmitted to external services unexpectedly.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code sends either a local file path or remote URL into `skill.get_output_analysis(...)`, which the surrounding error handling and CLI semantics indicate may invoke an external API, but the user is not explicitly warned that video content or references may be transmitted off-host. In a video-processing context, this can expose sensitive footage, personal data, or confidential surveillance material without informed consent or clear disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Enabling HTTPConnection debug logging and urllib3 debug output can leak full request and response metadata, potentially including tokens, identifiers, URLs, and payload contents to logs. In shared agent environments, debug logs may be accessible beyond the immediate user and can expose secrets or sensitive operational data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code reads a workspace API-key file to derive identity information without explicit user disclosure or narrow scoping. Accessing credential-adjacent files implicitly increases the skill's privilege and can cause sensitive workspace data to be consumed for unrelated authenticated behavior.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This code automatically transmits identity-bearing data such as openId/mobile and later token-bearing headers to external services without an explicit user-facing warning or consent flow. Because the skill is described as video search, the undisclosed networked identity operations are especially risky and exceed user expectations.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 98% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：mp4/avi/mov，最大 1GB |
| 🧑‍⚖️ 结果性质 | 搜索结果仅供参考，请以实际视频内容为准 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 72% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-video-search-analysis"
description: "Conducts intelligent video search based on target and semantic descriptions; supports conventional target retrieval, natural language description retrieval, and vectorized model matching. | 视频搜索/视频检索智能分析技能，基于目标、语义描述进行智能视频搜索，支持常规目标检索、自然语言描述检索、向量化模型匹配"
version: "1.0.5"
license: "MIT-0"
---

• Confidence: 79% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2