iaworker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it overstates its visual diagnosis abilities while producing physical repair guidance and defaults spoken output to an online TTS service.

Review this skill before installing. Treat its repair and diagnosis output as generic guidance, not reliable visual inspection. Avoid using it for safety-critical vehicle, electrical, structural, or high-risk repairs without expert verification. If privacy matters, switch TTS to the offline engine or disable speech before sharing sensitive task details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: scripts/speaker.py:69

Finding

Task Guidance Is Transmitted to an External TTS Service Without Explicit Privacy Consent

Content

View full analysis

None: try: with tempfile.NamedTemporaryFile(suffix=".mp3", delete=False) as f: tmp = f.name tts = gTTS(text=text, lang=self.lang, slow=(self.speed < 0.8)) tts.save(tmp) self._play_audio_file(tmp, block) Path(tmp).unlink(missing_ok=True) except Exception as e: print(f"[speaker] gTTS error: {e}") ``` The corresponding default configuration selects the online engine: ```yaml tts: engine: "gtts" # "gtts" (online) or "pyttsx3" (offline) lang: "en" speed: 1.0 volume: 1.0 enabled: true ``` ### Technical Analysis When speech output is requested, `gTTS` processes the supplied text through Google's online text-to-speech service. The text passed to this method can include generated step titles, difficulty classifications, and safety warnings derived from the user's task. The configuration comments identify `gtts` as online, but the program does not display a runtime privacy warning or obtain explicit consent immediately before transmitting text. Users may reasonably interpret speech generation as local audio processing, particularly because an offline engine is also supported. No evidence was found that image or video bytes are directly uploaded through this path. The exposed information is limited to text passed into `Speaker.speak`, such as generated task guidance. ### Attack Path 1. A user supplies an image, video, or task context that concerns private equipment or activity. 2. The application derives operating guidance from that context. 3. The user invokes the application with `--speak`. 4. `Speaker._speak_step` constructs text containing the step title, difficulty, and safety wa ...[truncated 949 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:289

Finding

Unpinned Third-Party Package Installation Instruction

Content

View full analysis

Remediation

View remediation

``` 2. Generate and enforce cryptographic hashes for dependency artifacts: ```bash pip install --require-hashes -r requirements.txt ``` 3. Commit a lock file generated by an appropriate dependency-management tool and update it through a controlled review process. 4. Replace the unpinned troubleshooting command with installation from the reviewed manifest: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Document the expected package index and advise users not to install from untrusted mirrors. 6. Periodically scan pinned dependencies for known vulnerabilities and review version updates before changing the lock file. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented functionality claims real-time visual analysis, TTS, and guided repair behavior, but the described implementation appears to be largely templated text generation rather than actual CV-based diagnosis. This mismatch is dangerous because users may rely on the system for physical repair or safety-critical guidance under false assumptions about its capabilities and validation, increasing the risk of harmful instructions or misuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module documentation claims the engine analyzes images and videos for physical tasks, but the implementation mainly emits generic templates and placeholder text. This mismatch is dangerous because downstream users and other components may trust the output as grounded visual diagnosis and produce unsafe repair or assembly instructions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The core analysis routine is effectively a stub that returns canned text based on task type rather than deriving conclusions from image or video content. In a skill that claims to diagnose damage and generate physical repair steps, this can mislead users into acting on fabricated or non-evidence-based guidance, creating real-world safety risk.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/video_analyzer.py (reported line 156)May include surrounding context.

python

"assembly": f"{img_str} Analyze parts and their relationships. What needs to be assembled?",
            "inspection": f"{img_str} Perform a thorough condition inspection. What is the state of this object?",
        }
        return prompts.get(task_type, f"{img_str} General analysis.")

    def _extract_anomalies(self, summary: str) -> list[str]:
        keywords = ["crack", "loose", "worn", "broken", "leak", "misaligned",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents behavior that would require shell execution and file writing, but it does not declare any explicit tool scope or permissions boundary. That creates an unsafe ambiguity: a host may grant broader capabilities than users expect, enabling filesystem modification or command execution without clear review or least-privilege constraints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Using Google TTS means step content may be transmitted to an external service, introducing data exposure and network dependency that are not inherent to local repair guidance. If user-provided descriptions, diagnostics, or sensitive context are spoken, this can leak private or proprietary information off-device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill enables cloud TTS without clearly informing users that spoken text may be sent to a third-party provider. This undermines informed consent and can expose sensitive operational details, repair descriptions, or user data to external processing without adequate notice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The configuration sets lang: "en" as the language for text-to-speech, which is a natural-language locale choice. There is no indication in this file that users can select another language or that the English-only setting is justified as region-specific, so this creates a locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When the gTTS engine is used, the provided text is sent to an external Google text-to-speech service, but the code gives no explicit warning or consent gate at the point of transmission. In this skill, spoken content may include user-provided diagnostic details, repair steps, or safety guidance derived from images/video analysis, so sensitive or proprietary information could be disclosed off-device unexpectedly.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/speaker.py (reported line 94)May include surrounding context.

python

if PLATFORM == "darwin":
            cmd = ["afplay", path]
        elif PLATFORM.startswith("linux"):
            cmd = ["aplay", path] if subprocess.run(["which", "aplay"], capture_output=True).returncode == 0 \
                  else ["paplay", path]
        elif PLATFORM == "win32":
            cmd = ["powershell", "-c", f"(New-Object Media.SoundPlayer '{path}').PlaySync()"]

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/speaker.py (reported line 100)May include surrounding context.

python

cmd = ["powershell", "-c", f"(New-Object Media.SoundPlayer '{path}').PlaySync()"]
        if cmd:
            if block:
                subprocess.run(cmd, capture_output=True)
            else:
                subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/speaker.py (reported line 102)May include surrounding context.

python

if block:
                subprocess.run(cmd, capture_output=True)
            else:
                subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

    def speak_only(self, text: str) -> None:
        self.speak(text, block=True)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The StepEngine initializer defaults the language to "en", which imposes a specific language setting in the skill behavior. Under the policy, forcing a language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The executable example creates StepEngine with lang="en", reinforcing an English-only usage pattern with no opt-in or alternative locale path shown. This is natural-language policy-sensitive because it directs operation in a fixed language rather than offering user selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill activates camera capture and performs live analysis without any explicit privacy notice, consent prompt, or warning that real-world surroundings may be observed. In a tool intended for live visual guidance, this increases the chance of unintentionally capturing sensitive environments, bystanders, documents, or other private information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The options table specifies --lang CODE as only en or zh, which imposes a narrow language policy in the skill's natural-language interface. The file does not document a justified regional limitation or broader user opt-in for unsupported locales.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The class defaults the language to "en", and the example instantiation also hard-codes English. This is a natural-language locale choice imposed by default rather than being selected by the user or clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The sample main block creates the speaker with lang="en", reinforcing a fixed English-only behavior. There is no user choice or locale negotiation shown here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.