Security audit

test

Security checks for vulnerabilities and agentic risk

Overview

This facial-analysis skill is review-worthy because it processes sensitive face and health media through a remote service while silently creating or reusing identity and report-history state.

Review before installing. Use this only if you are comfortable sending facial videos/images or supplied URLs to lifeemergence.com services for health-style analysis, and with the skill creating or reusing a local/remote identity to retrieve report history. Avoid broad automatic use on private media or internal URLs, and inspect or clear the workspace data database if you later remove the skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)
Confidence: 68% confidence
Finding: Using getattr(self.__model__, key) with unvalidated caller-supplied filter keys creates a mass-query surface where arbitrary model columns can be queried. While SQLAlchemy prevents direct SQL injection here, an attacker or unintended caller can probe sensitive fields such as token, email, or deletion flags and perform unauthorized filtering against data this generic DAO exposes.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) return query.scalar() finally:
Confidence: 68% confidence
Finding: This repeats the same unvalidated dynamic column selection pattern in count(), allowing arbitrary counting over sensitive or internal columns. In a user/token table, this can aid enumeration and inference attacks by confirming the existence of records matching attacker-chosen attributes.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to use shell execution, network access, local file reads/writes, and potentially environment-backed identity handling, but it declares no corresponding permissions or trust boundaries. This creates a capability/manifest mismatch that can lead to silent execution of sensitive actions without clear user or platform approval.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest advertises only local MP4 uploads and network video URLs for facial diagnosis, but the body expands behavior to images, multiple video formats, generic local files, and historical cloud report access. This scope drift is dangerous because users and enforcement systems may trust a narrower capability set than the skill actually attempts to use.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documented history-report cloud query is a separate data-access capability from facial analysis of user-supplied videos, yet it is not reflected in the manifest purpose. That hidden expansion increases the risk of unauthorized access to prior reports or unexpected transmission and retrieval of user-linked health data.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill manifest describes a face-analysis capability, but the configured endpoints point to generic health-analysis APIs and the file comments reference pet health diagnosis. This mismatch is dangerous because users may submit facial images/videos expecting one type of processing while the skill sends sensitive biometric/health data to a different backend workflow, creating a data handling and consent violation and potentially exposing data to an unintended service.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The inline comment identifies this as a pet health diagnosis configuration, which directly contradicts the published face-analysis skill intent. While a comment alone is not executable, in this context it is strong evidence of code reuse or misbinding that can lead maintainers to deploy or retain the wrong backend configuration for sensitive user media and medical-style inference.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script exposes a hidden capability to list historical face-analysis records via the suppressed --list and --open-id flags, while the help output does not clearly disclose this behavior to users. Because this operates on sensitive medical/biometric-adjacent history and uses internally resolved identity state, it can enable unintended record enumeration or privacy violations if invoked by another tool or caller that knows the hidden flags.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill accepts arbitrary http/https URLs and forwards them to a backend analysis service, which can cause the server to fetch attacker-controlled resources. This creates a classic SSRF-style trust boundary issue: even if the client only passes a string, the backend may be induced to access internal services, cloud metadata endpoints, or restricted network locations depending on server-side controls.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: This helper exposes broad generic CRUD and arbitrary HTTP request methods that go beyond the declared facial-diagnosis purpose of the skill. In a skill that is expected to upload videos and retrieve diagnosis results, these primitives can be reused by other code paths to call unintended internal or external endpoints, increasing the attack surface and enabling capability creep or abuse.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The file implements generic local user and database management capabilities that are not justified by the declared face-analysis purpose. In the context of a skill expected to upload videos for diagnosis, hidden identity persistence broadens the attack surface and creates unnecessary opportunities for collection, retention, and misuse of user data.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The User model stores identity and authentication-related data including username, realname, email, token, and open_token, which is not supported by the stated facial-diagnosis use case. If this database is accessible or mishandled, it enables credential/token leakage and privacy harm well beyond the expected behavior of the skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The debug log prints the full prompt and the generated session identifier, which can expose sensitive user input, diagnostic content, or internal correlation IDs to logs. In a facial diagnosis skill, prompts may contain health-related or personally sensitive information, so logging them verbatim increases privacy and data leakage risk.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The utility code manages persistent identity state by reading an open-id from a workspace file, reusing local database identities, and creating a default user when none exists. For a face-analysis skill, this exceeds the declared purpose and creates hidden identity persistence and account linkage behavior that users may not expect.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The HTTP helper silently calls /sys/phoneLogin with register=1 and user-derived identifiers to auto-create or log into an account before making requests. This is unrelated to facial video analysis and can cause undisclosed account creation, backend identity binding, and transmission of local identity data to a remote service.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The docstring describes reading an API key file, but the value is used as an internal open-id identity instead. This mismatch can mislead reviewers and users about what sensitive data is being consumed, undermining informed consent and making unsafe identity reuse harder to detect.

Vague Triggers

High

Confidence: 96% confidence
Finding: The default trigger says the skill should run whenever a user provides a video URL or file unless they mention certain unrelated analysis types, which is far too broad for a health-analysis tool. This can cause accidental invocation on generic media requests and send private content to a server-side diagnostic API without sufficiently specific user intent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The history-report triggers include broad everyday phrases like viewing reports or lists, which may match benign conversation and invoke cloud retrieval unexpectedly. In a medical context, unintended access to prior reports is sensitive because it may expose personal health information linked to an internally managed identity.

Missing User Warnings

High

Confidence: 97% confidence
Finding: Although the text mentions a server-side API, it does not clearly warn users that their uploaded videos or provided URLs will be transmitted to a remote service for analysis. Because the content involves facial imagery and health inference, lack of explicit disclosure materially increases privacy and consent risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill says attachments or video/image files are automatically saved locally, but this persistence is not presented as a clear warning to the user. Silent local storage of sensitive facial and health-related media increases the chance of unintended retention, later exposure, or misuse on the host system.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The API documentation instructs users to upload local MP4 videos or provide public video URLs for facial analysis, which involves highly sensitive biometric and health-related data. Without explicit warnings about privacy, transmission, storage, retention, third-party access, or the risks of using externally hosted URLs, users may unknowingly expose personal data or enable unsafe processing flows.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The tool sends a local video path or remote video URL into backend analysis logic without a clear user-facing disclosure that the content may be transmitted to an external service for processing. In a face-diagnosis context, the data is highly sensitive because it may contain identifiable facial imagery and health-related inferences, so users may unknowingly expose private information.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This skill uploads local video content or forwards remote video URLs to a server-side analysis API for facial/health diagnosis, but the file contains no explicit user-facing consent, privacy notice, or warning about transmission of sensitive biometric and health-related data. Because facial videos can contain highly sensitive personal information, silent transmission to an external service increases privacy, compliance, and data-handling risk.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code reads an arbitrary local file and transmits its full contents to a remote analysis API, but this file contains no user-facing consent, warning, or minimization controls. In an agent setting, that can lead to unintended exfiltration of sensitive local media or mislabeled files if upstream callers provide paths without clear disclosure.

Missing User Warnings

Low

Confidence: 77% confidence
Finding: Remote URLs are forwarded to the analysis service without user-facing disclosure that the backend, not the client, may retrieve the resource. This can mislead users about where the fetch occurs and creates privacy and trust risks in addition to the SSRF concerns tied to server-side retrieval.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2