Back to skill

Security audit

Passive Vital Signs Monitoring Tool | 无感生命体征监测分析工具

Security checks across malware telemetry and agentic risk

Overview

This health-video skill is purpose-related, but it needs review because it automatically uses cloud APIs, creates or reuses local identities, stores tokens, and can retrieve sensitive report history.

Install only if you are comfortable sending face/video health data and user-linked identifiers to the provider's cloud service, and with the skill creating local identity state and storing tokens for future report access. Treat the results as informational, not medical advice, and review the provider's privacy and retention practices before using it with sensitive footage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises only passive camera-based monitoring, yet the manifest and instructions imply capabilities to read/write local files, access environment-derived identity state, invoke shell commands, and make network requests without declaring permissions. This creates a transparency and least-privilege problem: users and hosting platforms cannot accurately assess what data the skill may access or where sensitive health-related artifacts may be sent.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest frames the skill as local camera-based vital-sign detection, but the body adds cloud history retrieval, report listing, and link generation. This mismatch can mislead users and reviewers about data flows, causing health-related media or metadata to be transmitted or exposed in ways not implied by the stated purpose.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill states that it will silently reuse or auto-create a local default user identity when no upstream identity is provided. For a health-monitoring skill, hidden identity persistence can cause cross-session data mixing, unauthorized access to another person's historical reports, or accidental linkage of sensitive biometric results to the wrong profile.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill accepts arbitrary http/https video URLs and forwards them for backend analysis, which expands the trust boundary beyond local camera footage into user-supplied remote resources. In a health-monitoring context this can enable server-side fetching of attacker-controlled content, create privacy/compliance issues, and permit analysis of untrusted sources inconsistent with the stated purpose.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file exposes a generic API helper that can perform paging, CRUD-style actions, and raw GET/POST/PUT/DELETE requests to caller-supplied URLs, which is materially broader than the manifest’s stated purpose of camera-based vital-sign analysis. In an agent-skill context, this creates unnecessary remote action capability that could be abused for unintended data exfiltration, backend interaction, or pivoting to other services if higher-level inputs are not tightly constrained.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The methods http_post, http_put, http_get, and http_delete directly forward caller-controlled URLs to the request layer, enabling arbitrary outbound network requests. For a skill described as passive, camera-based vital-sign monitoring, this capability is unjustified and increases the risk of SSRF-like behavior, unauthorized external communication, and exfiltration through attacker-influenced destinations.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The add, edit, and delete wrappers provide generic remote state-changing operations that are not supported by the skill’s analysis-only description. Even if intended as shared infrastructure, they expand the attack surface by enabling creation, modification, or deletion actions against remote services without clear business justification in this skill.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This file defines a local user/token persistence layer unrelated to the declared camera-based vital-sign monitoring purpose. Storing usernames, emails, tokens, and open tokens expands the data-collection surface and introduces credential/privacy risk without a clear need tied to the skill's stated function.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The DAO provides broad CRUD operations, schema mutation, and shared local database management that are much wider than the manifest's non-contact vital-sign analysis scope. In a camera-analysis skill, this mismatch increases the chance of hidden data retention, unauthorized local state manipulation, and privacy-impacting behavior beyond user expectations.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The utility layer performs remote account login/registration, token retrieval, and authenticated API calls that are unrelated to a camera-only vital-sign analysis skill. This creates an unnecessary identity and network side channel: invoking the skill can silently contact external services, establish accounts, and bind user context, which materially expands the attack surface and privacy risk.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code automatically resolves, creates, and persists default user identities, including generating usernames and storing/reusing them across runs. For a non-contact vital-sign monitoring skill, silent identity creation is unjustified and dangerous because it can track users, tie local activity to remote accounts, and operate without meaningful user awareness.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The utility inspects environment-derived workspace context and reads data/smyx-api-key.txt to obtain identity-like values. In the context of a camera-based health skill, this is excessive access to host/workspace metadata and secrets, increasing the chance of unintended credential reuse, privacy leakage, or cross-skill data coupling.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases for history lookup are broad enough that ordinary conversational requests could invoke cloud report retrieval unintentionally. In the context of sensitive health data, accidental execution may expose historical monitoring records or report links when the user did not clearly request retrieval.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill mandates automatic saving of uploaded image/video files to local storage without a user-facing warning or retention explanation. Because the files contain biometric/health-adjacent camera data, silent local persistence increases the risk of unauthorized access, over-retention, and forensic recovery.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill requires direct cloud API queries for historical reports but provides no privacy warning, consent flow, or data-handling disclosure. For biometric and health-related outputs, undisclosed cloud access can reveal sensitive historical records and report URLs, potentially violating user expectations and privacy obligations.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The code reads the entire local file and submits it to an external analysis service without any visible consent, warning, or minimization controls in this component. Because the skill processes health-related video, this can expose sensitive biometric and medical data, making undisclosed transmission materially risky from both privacy and compliance perspectives.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The request path transmits usernames, open IDs, tokens, and related metadata to external services, while debug mode can enable verbose HTTP logging at urllib3/http.client level. Even though some printing is truncated, lower-level debug logging may still expose sensitive headers or user-linked request data, creating confidentiality and privacy risks without clear user-facing disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
91% confidence
Finding
requests.post(_url, json=

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2