Back to skill

Security audit

Contactless Health Risk Screening Tool | 非接触式健康风险检测分析工具

Security checks across malware telemetry and agentic risk

Overview

This skill performs the advertised cloud health screening, but it also silently creates and persists identity tokens while handling sensitive face and health data.

Review before installing. This skill sends uploaded face images/videos or provided media URLs to a remote service, queries cloud health-report history, creates or reuses an internal identity, and stores authentication tokens locally. It should only be used where users have clearly consented to cloud processing of biometric and health-related data and understand that results are screening-only, not medical diagnosis.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (18)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
82% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
80% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill directs the agent to use shell commands, local files, network resources, and scripts, but the manifest declares no explicit permissions or user-facing disclosure of those capabilities. This creates a transparency and policy-enforcement gap: an agent may perform sensitive operations on files, environment/config, or remote services without clear authorization boundaries.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file does not implement the advertised contactless health-risk screening behavior and instead acts as a generic video-analysis/history wrapper around external skill calls. In a health-related skill, this mismatch is dangerous because users may rely on medical-sounding claims without any visible evidence in this component that the promised facial or physiological screening is actually being performed, creating deception, compliance, and unsafe reliance risks.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The CLI describes itself as a generic video analysis tool and only documents MP4 video inputs, which conflicts with the skill’s stated purpose of frontal facial image capture and multimodal physiological health screening. In a medical-risk context, misleading interface and documentation can cause improper use, false assumptions about capabilities, and unreviewed collection or processing of sensitive biometric/health data.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The module persists generic user/account data including usernames, real names, email, birthday, tokens, and open tokens, which is broader than the declared health-risk screening purpose. In a health-related skill, collecting and storing identity plus authentication artifacts expands the privacy and compromise blast radius, especially if not clearly justified, minimized, or protected.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The file exposes a generic `ai_chat(prompt, session_id, timeout)` capability that is not tied to the advertised contactless health-risk screening purpose. Even though the subprocess call is currently commented out, this creates an unnecessary agent-execution interface that could later be enabled or inherited elsewhere, expanding the attack surface and enabling arbitrary prompt-based interactions unrelated to the skill's stated function.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility provisions identities, performs login/registration flows, and persists tokens/user records locally, which is materially beyond the stated health-risk screening purpose. In a medical-analysis skill, hidden account creation and credential persistence increase privacy risk, expand attack surface, and enable undisclosed backend access under locally derived identities.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The code inspects agent workspace structure and creates `data/` and `skills/` directories, functionality unrelated to the advertised health-screening behavior. In context, this broadens filesystem reach and facilitates persistence or installation behavior that users would not reasonably expect from a health-analysis skill.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The default trigger is broad enough that any user providing a frontal face image for screening-related purposes may invoke the skill automatically. Because this skill processes sensitive biometric and health-related content, overly broad activation increases the chance of unintended collection, analysis, and transmission of regulated personal data.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The history-report trigger relies on broad keyword matching such as requests to view reports or lists, without strong scope checks or confirmation. In a health context, this can expose prior reports through accidental activation or cross-context queries, increasing the risk of unauthorized disclosure of sensitive medical information.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill states that attachments are automatically saved locally and that history queries must call a cloud API, but it does not prominently warn users that uploaded face images/videos and report queries are sent to remote services. Given that the data includes facial imagery, inferred physiological metrics, and health-risk reports, the lack of explicit disclosure and consent is especially dangerous from both privacy and compliance perspectives.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This code reads arbitrary local files or accepts remote video URLs and forwards them to an analysis API, but the file contains no user-facing consent notice, privacy warning, or destination transparency. In a health-risk screening skill processing facial/physiological data, silent transmission of highly sensitive biometric and health-related content materially increases privacy, compliance, and data-exfiltration risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The request helper can send usernames, open IDs, tokens, and login data to external services, but this file provides no user-facing disclosure or consent boundary before doing so. Because the skill is framed as health-risk detection, undisclosed transmission of identity/authentication material is especially sensitive and may expose both personal and medical-context metadata.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The utility silently reads a workspace file `data/smyx-api-key.txt` to derive an identity value, which is credential-adjacent behavior not obvious from the skill description. Even if intended for convenience, accessing local secret-like material without clear notice creates privacy and trust concerns and may lead to unintended account linkage.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档,保持上下文简洁 |
| 📁 格式支持 | 支持格式:jpg/jpeg/png/mp4/avi/mov,视频推荐时长 10-30 秒,最大 10MB |
| 🧑‍⚖️ 结果性质 | **⚠️ 重要声明**:本分析结果仅供早期风险筛查参考,**不替代专业医疗诊断和检查**,发现高风险请及时到医院就诊 |
| 🚫 脚本限制 | 禁止临时生成脚本,只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数,不需要下载本地,默认地址都是公网地址,api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候,从接口返回 json 数据中提取字段  作为超链接地址,且自动转化为如下 Markdown |
Confidence
76% confidence
Finding

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "contactless-health-risk-detection-analysis"
description: "Combines frontal facial image capture with multimodal physiological feature analysis to provide early risk screening and alerts for chronic and acute conditions such as heart attack, stroke, hypertension, and hyperlipidemia. | 非接触式健康风险识别技能,通过正面人像采集结合多模态生理特征分析,提供心梗、脑梗、高血压、高血脂等慢病急症早期风险筛查预警"
version: "1.0.13"
license: "MIT-0"
---
Confidence
72% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2