Back to skill

Security audit

Arrhythmia Early Warning Analysis Tool | 心律失常早期预警分析工具

Security checks across malware telemetry and agentic risk

Overview

The skill matches its advertised cloud health-video analysis purpose, but it automatically handles identity, stores tokens locally, and sends sensitive video/report data to external services with incomplete disclosure.

Review this before installing: face videos or video URLs may be sent to LifeEmergence cloud APIs, prior health reports may be queried automatically, and a workspace identity/default account plus tokens may be created and stored locally. Avoid private or tokenized URLs, use only intentionally selected video files, and treat results as screening information rather than a medical diagnosis.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
66% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
66% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no explicit permissions while instructing the agent to perform shell execution, local file handling, network access, and possible environment use. This creates a capability transparency gap: users and platforms cannot accurately assess what sensitive operations the skill may perform before execution, which is especially risky for a health skill that handles face videos and report retrieval.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The function exposes a capability to retrieve prior analysis records by open_id, which is outside the stated purpose of analyzing a supplied facial video. In a health-related skill, listing historical analyses tied to an internal identity can disclose sensitive medical inference data and broadens the attack surface for unauthorized data access or enumeration.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code initializes internal user identity handling even for a CLI tool whose primary function should be direct input analysis. In this context, binding execution to an internal identity mechanism increases the chance of silent account-context use, cross-user data access, or privacy violations involving health-related outputs.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The implementation does not contain arrhythmia-specific analysis, validation, or safeguards; it is a generic wrapper around a backend `skill.get_output_analysis(...)` call. In a medical-context skill, this mismatch is dangerous because users may rely on claimed heart-rhythm screening capabilities without any visible evidence of domain-specific processing, calibration, or safety checks, creating deceptive functionality and unsafe clinical overtrust.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The script exposes history retrieval by `open_id`, which is unrelated to the stated single-purpose function of facial-video arrhythmia screening. In a health-related skill, this broadens access to account-associated analysis records and increases privacy risk, especially if `open_id` resolution or authorization is weak elsewhere in the stack.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This file implements a broad, generic API/CRUD wrapper that is not limited to arrhythmia analysis functions. In a health-analysis skill, such generalized remote interaction expands the attack surface and can enable unexpected data access, transmission, or backend actions unrelated to the stated purpose, especially if other parts of the skill can pass attacker-controlled URLs or payloads into these helpers.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
A user account lookup helper is unrelated to facial-video arrhythmia detection and creates unnecessary identity and enumeration capability. If exposed through the skill or misused internally, it could facilitate user discovery, privacy violations, or coupling of sensitive health workflows with account reconnaissance.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The add/edit/delete and generic HTTP methods provide arbitrary data-management capabilities that exceed what a diagnostic support skill should need. In this context, they increase the chance that the skill can modify or delete backend records, transmit sensitive data, or be repurposed for unintended administrative actions if request targets or payloads are influenced by untrusted input.

Description-Behavior Mismatch

High
Confidence
89% confidence
Finding
This code defines a persistent local user/account database layer that is unrelated to the stated arrhythmia early-warning function. Such hidden identity storage expands the attack surface, introduces privacy risk, and may collect or retain user data without clear necessity or expectation, which is especially sensitive in a health-related skill.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The DAO automatically creates tables and alters schema on initialization, despite the skill being described as analysis-only early warning. Silent persistence and schema mutation create undisclosed side effects, increase local statefulness, and can retain sensitive user information beyond the expected scope of a facial-video analysis tool.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This utility code provisions identities and can silently register or log in users against a remote health endpoint, which is unrelated to the stated facial arrhythmia analysis purpose. That creates hidden account creation and identity transmission behavior, expanding the skill from analysis into undisclosed remote account operations and exposing users to privacy and consent risks.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The code reads a workspace identity file, derives identities from local state, and persists generated usernames in a local database even when the caller did not explicitly provide an identity. For a medical-analysis skill, this hidden identity harvesting and persistence is unnecessary and increases the chance of privacy violations, cross-skill tracking, and unauthorized reuse of user identifiers.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The workspace discovery logic inspects environment variables and filesystem layout to locate agent roots, data, and skills directories. While likely intended for framework convenience, it broadens this skill's ability to discover and interact with agent workspace structure in ways unrelated to arrhythmia detection, which increases attack surface and enables access to sensitive locations if reused unsafely elsewhere.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The history-report trigger phrases are broad enough that ordinary user requests like asking about prior reports could automatically invoke cloud history retrieval. In a medical context, that can expose sensitive report metadata or links without sufficiently clear user intent or confirmation.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill asks for face videos or remote video URLs and states that an API service will automatically download/process them, but it does not prominently warn users that biometric/health-related data is being sent to a cloud service. Because facial video and arrhythmia-related outputs are highly sensitive, lack of informed consent and data-flow disclosure is a significant privacy and compliance risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill reads arbitrary local video files and uploads their full contents to an external analysis service, but this code provides no user-facing notice, confirmation, or consent gate before transmission. Because the skill processes health-related facial video, the uploaded data is especially sensitive and may contain biometric and medical information, increasing privacy and compliance risk.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill forwards user-supplied remote video URLs directly to the backend analysis service without disclosing that a third-party service will fetch or process that URL. This can expose sensitive URLs or tokens embedded in links and may cause the external service to access resources the user did not expect to share.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code sends user-supplied local video paths or remote URLs to backend analysis without any clear user-facing disclosure that sensitive biometric/health video may be transmitted for remote processing. Because this skill is framed as cardiac-risk screening from facial video, the data involved is highly sensitive, making undisclosed remote processing a significant privacy and consent issue.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The history-listing path retrieves account-associated analysis data based on `open_id` with no user-facing notice that prior health-analysis records may be accessed. In the context of a medical screening skill, undisclosed access to historical records raises privacy, consent, and potential cross-account exposure concerns.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The code performs database creation and schema-altering operations automatically, without any user-facing disclosure or confirmation. In a health-oriented skill, silent local persistence and mutation of user/account tables can undermine informed consent and increase privacy/compliance risk even if not directly exploitable as code execution.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads a sensitive workspace file containing an API key or identity value without any user-facing disclosure or consent. In the context of a health-analysis skill, silently consuming local identity material is especially problematic because users would not reasonably expect medical inference tooling to inspect workspace credentials.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The request layer automatically attaches tokens, API keys, and user identifiers to outbound HTTP requests, with no evident user-facing disclosure. Combined with the health-related skill context, this means sensitive identity and potentially health-associated activity can be sent to remote services unexpectedly, creating significant privacy and trust concerns.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2