Passive Vital Signs Monitoring Tool | 无感生命体征监测分析工具

• Outcome: Review
• Latest audit: Sep 13, 2026 · 12:58 PM UTC
• Version: 1.0.16

Overview

This skill appears to perform the advertised vital-sign video analysis, but it also silently creates or reuses an identity, stores reusable tokens, retrieves cloud history, and ships with insecure plaintext development endpoints for sensitive biometric data.

Treat this as a Review item before installing. Do not use it with real face videos or health data unless the publisher switches the release configuration to HTTPS production endpoints, documents exactly what is uploaded and stored, requires clear consent for identity creation and history retrieval, and protects stored credentials with an appropriate secret store.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/smyx_common/scripts/config-dev.yaml:2
• Finding: Sensitive biometric media and authentication tokens transmitted over plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/config.yaml:15`, `skills/smyx_common/scripts/config-dev.yaml:2-4`, `skills/smyx_analysis/scripts/skill.py:126-130`, `skills/smyx_common/scripts/util.py:610-612,646` **Vulnerability Type**: Insecure transport of sensitive data **Risk Level**: High ### Vulnerable Code `skills/smyx_common/scripts/config.yaml:15` ```yaml env: dev ``` `skills/smyx_common/scripts/config-dev.yaml:2-4` ```yaml ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ``` `skills/smyx_analysis/scripts/skill.py:126-130` ```python with open(input_path, 'rb') as f: file_content = f.read() files = { 'file': (os.path.basename(input_path), file_content, mime_type) } ``` `skills/smyx_common/scripts/util.py:610-612,646` ```python headers.setdefault("X-Access-Token", ApiEnum.TOKEN) headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY) headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN) ``` ```python response = requests.request(method, url, *args, json=data, params=params, headers=headers, timeout=int(timeout), **argss) ``` ### Technical Analysis The distributed default configuration explicitly selects the `dev` environment. This overrides the HTTPS service addresses in the base configuration with plaintext HTTP endpoints on `192.168.1.234`. The analysis workflow reads a user's face video into memory and passes it as a multipart upload to the common request function. That request function also attaches access tokens, API credentials, authorization tokens, and a user identifier. When the active development endpoints are used, neither the request body nor the authentication headers receive transport-layer confidentiality or integrity protection. Uploading video to a remote service is consistent with the Skill's documented cloud-analysis fun ...[truncated 1674 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the distributed configuration to select a production environment that uses HTTPS. 2. Remove development and private-network endpoints from release artifacts, or place them in a separate, explicitly opted-in developer configuration. 3. Enforce HTTPS in `RequestUtil.http_request` and reject plaintext HTTP endpoints before adding credentials or transmitting files. 4. Permit an HTTP exception only for tightly controlled test environments, with an explicit insecure-development flag and no real user data or production credentials. 5. Retain standard certificate and hostname verification; do not disable TLS verification. 6. Consider certificate pinning where the deployment model permits it. 7. Rotate all tokens that may previously have been transmitted through the plaintext development endpoints. 8. Add automated tests and release checks that fail when an active endpoint begins with `http://`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/smyx_common/scripts/dao.py:460
• Finding: Reusable authentication tokens stored unencrypted in a shared workspace database<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/dao.py:151-181,460-461`, `skills/smyx_common/scripts/util.py:586-606` **Vulnerability Type**: Plaintext credential storage **Risk Level**: Medium ### Vulnerable Code `skills/smyx_common/scripts/dao.py:151-181` ```python if not final_path.startswith(expected_prefix): raise RuntimeError( f"Database path validation failed!\n" f" Expected prefix: {expected_prefix}\n" f" Actual path: {final_path}\n" f" Databases may not be created outside the workspace data directory!" ) return final_path def __init__(self, db_path: str = None): """ Initialize DAO :param db_path: SQLite database file path """ if not db_path: db_path = "smyx-common-claw.db" db_path = self.get_db_path(db_path) self.engine = create_engine(f"sqlite:///{db_path}", echo=False) ``` `skills/smyx_common/scripts/dao.py:460-461` ```python token = Column(String(500), comment="token") open_token = Column(String(1000), comment="open token") ``` `skills/smyx_common/scripts/util.py:586-606` ```python if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) ``` ### Technical Analysis The Skill retrieves reusable authentication tok ...[truncated 2160 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Avoid persistent token storage when request-scoped or short-lived credentials are sufficient. 2. Store reusable credentials in an operating-system keychain, managed secret service, or encrypted credential store rather than ordinary SQLite columns. 3. If database persistence is unavoidable, encrypt token values with a key kept outside the database and outside the workspace. 4. Create database files with restrictive owner-only permissions and verify permissions after creation. 5. Separate authentication storage from the general shared workspace database and restrict access to the component that performs API authentication. 6. Use short-lived, narrowly scoped tokens and refresh them through a secure flow. 7. Revoke tokens immediately after logout, suspected disclosure, or authentication errors. 8. Redact credentials from backups, diagnostics, and exported workspace archives. 9. Rotate existing persisted tokens after deploying secure storage. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (54)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines remote authenticated API communication, local file and directory creation, user identity generation/persistence, database interaction, environment detection, and token/payment logic under the label of contactless vital-sign monitoring. That is a serious trust-boundary problem: a user supplying medical-adjacent video could instead be enrolled into a broader account and data-processing system without clear informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines remote authenticated API communication, local file and directory creation, user identity generation/persistence, database interaction, environment detection, and token/payment logic under the label of contactless vital-sign monitoring. That is a serious trust-boundary problem: a user supplying medical-adjacent video could instead be enrolled into a broader account and data-processing system without clear informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines remote authenticated API communication, local file and directory creation, user identity generation/persistence, database interaction, environment detection, and token/payment logic under the label of contactless vital-sign monitoring. That is a serious trust-boundary problem: a user supplying medical-adjacent video could instead be enrolled into a broader account and data-processing system without clear informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines remote authenticated API communication, local file and directory creation, user identity generation/persistence, database interaction, environment detection, and token/payment logic under the label of contactless vital-sign monitoring. That is a serious trust-boundary problem: a user supplying medical-adjacent video could instead be enrolled into a broader account and data-processing system without clear informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines remote authenticated API communication, local file and directory creation, user identity generation/persistence, database interaction, environment detection, and token/payment logic under the label of contactless vital-sign monitoring. That is a serious trust-boundary problem: a user supplying medical-adjacent video could instead be enrolled into a broader account and data-processing system without clear informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines remote authenticated API communication, local file and directory creation, user identity generation/persistence, database interaction, environment detection, and token/payment logic under the label of contactless vital-sign monitoring. That is a serious trust-boundary problem: a user supplying medical-adjacent video could instead be enrolled into a broader account and data-processing system without clear informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines remote authenticated API communication, local file and directory creation, user identity generation/persistence, database interaction, environment detection, and token/payment logic under the label of contactless vital-sign monitoring. That is a serious trust-boundary problem: a user supplying medical-adjacent video could instead be enrolled into a broader account and data-processing system without clear informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This mismatch combines remote authenticated API communication, local file and directory creation, user identity generation/persistence, database interaction, environment detection, and token/payment logic under the label of contactless vital-sign monitoring. That is a serious trust-boundary problem: a user supplying medical-adjacent video could instead be enrolled into a broader account and data-processing system without clear informed consent.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "contactless-vital-signs-monitoring-analysis"
description: "Non-contact detection of heart rate, respiration, blood oxygen, and heart rate variability. No wearable devices are required; monitoring is achieved solely through camera footage. | 无感生命体征监测分析技能，非接触检测心率、呼吸、血氧、心率变异性，无需穿戴设备，通过摄像头画面即可监测"
version: "1.0.16"
license: "MIT-0"
---

# 💗 Passive Vital Signs Monitoring Tool | 无感生命体征监测分析工具

> **智能健康/识别分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询

---

## �

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill handles highly sensitive health video and report data but does not clearly warn users that content may be transmitted to a cloud API and stored as reports. In a biometric/medical context, missing privacy disclosure is especially dangerous because users may unknowingly share regulated or intimate data without informed consent.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The tool accepts local video files or remote URLs for analysis and passes them to downstream logic without any explicit warning that highly sensitive biometric video data may be uploaded or otherwise transmitted to external services. In the context of contactless vital-sign monitoring, the data is especially privacy-sensitive, so silent transmission or remote fetching can expose medical and personal information.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file defines a generic user/account persistence layer, including user identity fields and account lookup behavior, which is materially outside the declared purpose of non-contact vital-sign analysis. Capability mismatch increases the chance of undisclosed data collection and covert account handling, especially in a skill that should primarily process camera-derived biometric signals.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The user model stores token and open_token fields, which are sensitive authentication artifacts unrelated to the stated vital-sign monitoring function. Persisting such secrets in a local SQLite file materially increases compromise impact because theft of the database may enable account takeover or unauthorized API access.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The utility layer performs remote login/account creation and token acquisition completely unrelated to the stated purpose of camera-only vital-sign analysis. This creates an undisclosed external identity and authentication channel, sending user-linked identifiers to remote services and expanding the skill's trust boundary far beyond what users would reasonably expect.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit tool scope or permission boundaries, yet the described and detected capabilities include shell execution, network access, environment access, and file read/write. In an agent setting, missing tool constraints increases the blast radius of prompt misuse, accidental overreach, and abuse of sensitive local or remote resources.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The history-report triggers are broad enough that ordinary phrases may automatically invoke cloud report retrieval. Because the reports concern sensitive health monitoring, accidental triggering can expose private report metadata or fetch data the user did not clearly request.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill automatically reuses or creates an internal/default local user and links reports without user opt-in or visibility. In the context of health monitoring, silent identity creation and reuse undermines consent, can commingle data across sessions, and increases the risk of unauthorized report association.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a monitoring-analysis tool but also exposes show_analyze_list(open_id), which retrieves prior analyses for an account scope. Mixing analysis with account-history retrieval broadens access to potentially sensitive medical data and creates an unexpected data exposure surface beyond the advertised purpose.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The CLI initializes an internal user identity via a hidden --open-id parameter and OpenIdUtil.resolve_current_open_id(), even though this capability is unrelated to core vital-sign analysis and is not disclosed in normal help output. Hidden identity handling increases the risk of unauthorized access to account-scoped data or implicit use of privileged/internal context without informed user consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code resolves a current internal open_id automatically and does so without user-facing disclosure because the argument is suppressed from help output. Hidden identity selection can cause actions to run under an internal or inferred account context, making data access and attribution opaque and increasing the chance of privacy violations.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The method returns a fixed Chinese-language string, which imposes a specific language on all users of this skill. The file does not indicate any user opt-in, language selection, or justified region-specific limitation, which fits the language/locale policy violation criteria.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code reads arbitrary local video files into memory and submits their contents to an external analysis service, but this file contains no user-facing disclosure, consent check, or trust boundary enforcement before transmitting potentially sensitive biometric footage. In the context of a contactless vital-sign monitoring skill, the uploaded content likely contains highly sensitive health-related and visual data, making silent exfiltration to a backend materially risky.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest promises camera-based detection of heart rate, respiration, blood oxygen, and HRV, but this file presents itself as a generic "视频分析工具" and only forwards inputs to broad methods like get_output_analysis and get_output_analysis_list. Nothing in the code constrains analysis to vital-sign measurement or indicates outputs specific to the declared biometric scope, creating a semantic mismatch between the advertised purpose and implemented behavior.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2