Security audit

test

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it can upload facial videos to a remote health service, silently link a user identity, store tokens locally, and retrieve cloud health-style reports.

Install only if you are comfortable sending facial videos or video URLs to lifeemergence.com services and having reports associated with an automatically managed identity. Avoid using third-party videos without consent, assume cloud history may be retrievable through this skill, and review local workspace data for stored service tokens if you uninstall or share the workspace.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:57
Finding: Automatic routing can upload biometric media without explicit facial-analysis consent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:548
Finding: Platform identity and reusable authentication tokens are silently collected and stored in plaintext
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/skill.py:102
Finding: Unrestricted URLs are delegated to a privileged backend fetch operation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/smyx_common/scripts/util.py:568
Finding: Shared HTTP helper attaches authentication credentials to arbitrary absolute URLs
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependency manifest uses an ambiguous YAML package name and lacks a fully reproducible request dependency
Content: View full analysis
=2.28.0 ``` The implementation imports the module as follows: ```python import yaml ``` ### Technical Analysis The standard Python distribution that provides the `yaml` import is conventionally named `PyYAML`, while the project manifest declares `yaml`. A mismatch between an import name and distribution name can cause installation failure or create dependency-confusion exposure if installers use an unintended similarly named package. In addition, `requests>=2.28.0` is specified only as a lower bound in the documentation and does not appear in the root manifest shown during the audit. An unrestricted upper range allows future, unreviewed releases to be selected, while inconsistent dependency declarations make the actual runtime environment difficult to reproduce. No malicious dependency payload was identified in the repository. The risk arises from ambiguous or inconsistent package resolution during installation. ### Attack Path 1. An operator installs dependencies from the project manifest or documentation. 2. The package resolver attempts to resolve the ambiguous `yaml` distribution name or a future unrestricted `requests` release. 3. An unintended, compromised, or incompatible distribution is selected from the configured package index. 4. Package installation hooks or imported package code execute with the installer or Skill process privileges. ### Impact Assessment Dependency installation and import-time code execute with the privileges of the environment running the Skill. A compromised dependency could therefore access the same local files, environment variables, stored tokens, ...[truncated 171 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding indicates the skill reads local workspace files for identity, manipulates workspace directories, creates or reuses local user identities, performs automatic phone login/registration to external health APIs, manages tokens, and injects auth headers for arbitrary requests. In a health-oriented facial-analysis context, this is highly dangerous because it combines sensitive biometric/medical data handling with undisclosed identity brokerage, credential management, local data access, and broad outbound request capability.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "face-analysis" description: "Supports uploading local MP4 videos or network video URLs to call the server-side API for facial diagnosis. It returns structured TCM facial diagnosis results. | 支持通过上传本地 MP4 视频或网络视频 URL，调用服务端 API 进行面部诊断，返回结构化的中医面诊结果" version: "1.0.6" license: "MIT-0" --- # 🧑‍⚕️ TCM Facial Diagnosis Analysis Tool | 中医面诊分析工具 > **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询 --- ## 🧭 技能概览 | Overview | 模块 | 内容 | |---|---| |

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description says users can upload facial videos or provide URLs to a server-side API but does not prominently warn about the privacy implications of transmitting biometric and potentially health-related data off-device. For a medical-adjacent facial-analysis tool, omission of this disclosure meaningfully increases consent and data-protection risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This utility layer silently performs identity resolution, account lookup/creation, login, and token persistence, which is materially broader than the declared face-analysis purpose. That creates hidden authentication side effects and enables the skill to operate under a local or derived identity without explicit user consent, increasing the risk of unauthorized account use, privacy violations, and unexpected backend actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill requests or implies capabilities including shell, network, file read/write, and environment access, but the manifest does not declare any tool scope restrictions. In an agent setting this weakens least-privilege controls, making it easier for a misleading or overbroad skill to access resources beyond what users would reasonably expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default trigger activates on generic video-analysis requests unless users mention several exclusions. Such broad triggering can cause the skill to process or upload facial videos when the user intended a different analysis path, which is especially sensitive given biometric and health-related data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The history-report trigger relies on broad everyday phrases like viewing reports or lists, which may inadvertently fetch cloud-hosted historical medical reports. In this context, accidental disclosure of prior facial-health reports is a meaningful privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation describes transmitting MP4 videos or public video URLs for facial analysis, which involves highly sensitive biometric data, but it provides no privacy warning, consent guidance, retention notice, or data-handling expectations. In the context of a face-analysis skill tied to health-style diagnosis, this omission increases the risk that users or integrators send sensitive personal data without understanding exposure, storage, or compliance implications.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The inline documentation at L02 says this is a '宠物健康诊断分析工具配置文件' (pet health diagnosis analysis tool configuration file), while the surrounding skill manifest describes facial diagnosis from MP4 videos or video URLs. The code then sets generic health-analysis endpoints rather than anything clearly tied to facial diagnosis, so the documentation actively points to a different tool/domain than the declared skill intent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill includes a history-listing capability via show_analyze_list() that is not described in the manifest, which only mentions uploading a video or URL for diagnosis and returning results. Hidden functionality that retrieves prior facial-analysis records expands access to sensitive health-related data and can violate user expectations and least-privilege design.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code initializes and relies on an internal open_id identity mechanism even though identity binding is not necessary for the stated purpose of one-off video analysis. Introducing hidden identity linkage for a biometric/health-adjacent workflow increases privacy risk, enables silent account correlation, and broadens what backend data may be accessed under the hood.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: OpenIdUtil.resolve_current_open_id(...) performs internal identity resolution without clear user disclosure or an obvious opt-in path. In a facial diagnosis skill, silently attaching a persistent identifier to requests raises privacy concerns because sensitive biometric/medical inferences may be tied to a user account without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The tool sends either a local video path or remote video URL to a server-side analysis function without a clear user-facing disclosure that data will be transmitted off-host. Because facial videos are highly sensitive personal data, lack of explicit transmission notice meaningfully increases privacy and consent risk even if network use is functionally expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill returns natural-language strings such as '面诊分析结构化结果' and other Chinese-only messages throughout the file. This imposes a fixed locale on all users with no opt-in, fallback, or language-selection mechanism, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code reads arbitrary local file contents and uploads them to a server-side analysis API, but the code path contains no user-facing confirmation, disclosure, or consent checkpoint before exfiltrating data. In a skill that processes local media, this is more dangerous because users may provide sensitive videos containing faces, surroundings, or metadata, and the skill directly transfers that content off-device.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The method is named SMYX_HYDROPONIC_NUTRIENT_ASSESSMENT_ANALYSIS, which denotes hydroponic nutrient assessment, but its docstring and implementation clearly retrieve face-diagnosis report lists. This is not merely incomplete documentation; the identifier actively points to a different skill intent than the code actually serves.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2