Passive Vital Signs Monitoring Tool | 无感生命体征监测分析工具

• Outcome: Review
• Latest audit: Oct 13, 2026 · 6:20 PM UTC
• Version: 1.0.19

Overview

This skill performs the advertised cloud-based vital-sign analysis, but it also silently creates or reuses an identity, stores account tokens locally, and can retrieve health-report history without enough user-facing privacy control.

Install only if you are comfortable sending face/video or video URLs to the lifeemergence.com cloud services and having a local workspace identity and tokens reused for future report lookups. Use a separate workspace/account for sensitive testing, avoid shared machines, and review/delete the workspace data database if you no longer want the identity or tokens retained.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill reportedly performs authenticated external API calls, local file reads/writes, workspace/environment inspection, local identity persistence, and remote login/registration while claiming to be a contactless vital-sign tool. In this context, that is a serious transparency and privacy problem because users may submit sensitive health-related media without understanding the account linkage, token handling, or remote transmission involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill reportedly performs authenticated external API calls, local file reads/writes, workspace/environment inspection, local identity persistence, and remote login/registration while claiming to be a contactless vital-sign tool. In this context, that is a serious transparency and privacy problem because users may submit sensitive health-related media without understanding the account linkage, token handling, or remote transmission involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill reportedly performs authenticated external API calls, local file reads/writes, workspace/environment inspection, local identity persistence, and remote login/registration while claiming to be a contactless vital-sign tool. In this context, that is a serious transparency and privacy problem because users may submit sensitive health-related media without understanding the account linkage, token handling, or remote transmission involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill reportedly performs authenticated external API calls, local file reads/writes, workspace/environment inspection, local identity persistence, and remote login/registration while claiming to be a contactless vital-sign tool. In this context, that is a serious transparency and privacy problem because users may submit sensitive health-related media without understanding the account linkage, token handling, or remote transmission involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill reportedly performs authenticated external API calls, local file reads/writes, workspace/environment inspection, local identity persistence, and remote login/registration while claiming to be a contactless vital-sign tool. In this context, that is a serious transparency and privacy problem because users may submit sensitive health-related media without understanding the account linkage, token handling, or remote transmission involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill reportedly performs authenticated external API calls, local file reads/writes, workspace/environment inspection, local identity persistence, and remote login/registration while claiming to be a contactless vital-sign tool. In this context, that is a serious transparency and privacy problem because users may submit sensitive health-related media without understanding the account linkage, token handling, or remote transmission involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill reportedly performs authenticated external API calls, local file reads/writes, workspace/environment inspection, local identity persistence, and remote login/registration while claiming to be a contactless vital-sign tool. In this context, that is a serious transparency and privacy problem because users may submit sensitive health-related media without understanding the account linkage, token handling, or remote transmission involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill reportedly performs authenticated external API calls, local file reads/writes, workspace/environment inspection, local identity persistence, and remote login/registration while claiming to be a contactless vital-sign tool. In this context, that is a serious transparency and privacy problem because users may submit sensitive health-related media without understanding the account linkage, token handling, or remote transmission involved.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

The YARA hit for metadata/tool poisoning indicators suggests suspicious or malformed manifest content that could be used to influence tool interpretation or conceal behavior. While the exact cause is not fully visible from SKILL.md alone, in combination with the broad behavior mismatch and undeclared capabilities, this raises concern that the manifest may be crafted to misrepresent the skill's true function.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "contactless-vital-signs-monitoring-analysis"
description: "Non-contact detection of heart rate, respiration, blood oxygen, and heart rate variability. No wearable devices are required; monitoring is achieved solely through camera footage. | 无感生命体征监测分析技能，非接触检测心率、呼吸、血氧、心率变异性，无需穿戴设备，通过摄像头画面即可监测"
version: "1.0.20"
license: "MIT-0"
---

# 💗 Passive Vital Signs Monitoring Tool | 无感生命体征监测分析工具

> **智能健康/识别分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询

---

## �

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill handles sensitive health-related media and report queries but does not prominently warn users that videos, URLs, and report lookups may be sent to a cloud API. In a medical-like context, missing privacy disclosure materially increases the risk of uninformed consent, regulatory issues, and exposure of biometric or health-adjacent data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The model stores token and open_token fields for a camera-only vital-sign monitoring skill, which is context-inappropriate and materially raises the impact of compromise. Persisting authentication tokens in a local SQLite database can enable account takeover or unauthorized API access if the host or database file is exposed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility layer performs remote account provisioning, token acquisition, and authenticated request handling that are unrelated to contactless vital-sign analysis. In the context of a camera-based health-monitoring skill, silently creating accounts and managing cross-service authentication expands scope beyond user expectations and can transmit identity data to external services without clear consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope or permission boundaries, yet the documented workflow and associated scripts imply shell execution, file access, environment-variable use, network access, and local writes. In an agent environment, missing capability scoping increases the chance that a seemingly narrow health-analysis skill can access broader local and remote resources than users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The history-report trigger phrases are broad enough that ordinary conversational requests could unintentionally invoke cloud report retrieval. Because the skill concerns health data, accidental triggering can expose sensitive historical reports or metadata with little user intent confirmation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script includes hidden internal-identity handling and a list operation unrelated to the advertised vital-sign analysis function. It silently resolves an internal open_id and exposes a --list mode that can enumerate prior analysis records, creating an access-control and privacy risk if unauthorized users can invoke the skill or if identity is inferred implicitly.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Multiple user-visible strings are fixed in Chinese, such as the report heading and export-link text, with no indication that the user can opt into another language. This can violate language/locale policy when a skill forces a specific language without user choice or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill returns several fixed Chinese-language messages for status, errors, and list output, including missing results and input validation failures. There is no evidence in this file of locale selection or a documented region-specific limitation, so the skill appears to enforce one language by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code reads arbitrary local video files into memory and uploads them to a remote analysis service without any visible consent prompt, warning, or privacy notice in this skill layer. Because this skill processes camera footage for health-related inference, the uploaded content may contain highly sensitive biometric and medical data, making silent transmission particularly risky.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill for non-contact vital-sign analysis from camera footage, but this file implements a broad API service layer with generic pagination, add/edit/delete operations, arbitrary HTTP GET/POST/PUT/DELETE methods, and user lookup. Those capabilities are not themselves tied to heart rate, respiration, blood oxygen, or HRV analysis and indicate behavior substantially broader than the declared biometric-analysis scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Methods for add, edit, delete, and generic HTTP PUT/DELETE expose remote state-changing capabilities unrelated to the stated purpose of passively analyzing camera footage for vital signs. A monitoring-analysis skill may reasonably call specific inference APIs, but generic mutation helpers are broader administrative capabilities without clear justification from the manifest.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is described as a narrowly scoped non-contact vital-sign monitoring capability, but this file exposes a large catalog of scene codes for unrelated functions such as stranger recognition, smoking detection, infant monitoring, plant diagnostics, livestock analysis, and workplace emotion analysis. Bundling this broad capability-routing surface into the skill is not justified by the stated purpose of heart rate, respiration, SpO2, and HRV monitoring from camera footage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file implements generic user persistence for usernames, real names, email, birthdays, and related account metadata even though the declared skill purpose is contactless vital-sign monitoring from camera footage. That mismatch increases the risk of unnecessary personal data collection and retention, broadening the privacy and attack surface without clear functional justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill for non-contact detection of heart rate, respiration, blood oxygen, and HRV from camera footage. However, ai_chat is a generic function intended to invoke an openclaw agent with arbitrary prompts and session IDs, which is not an obvious or necessary capability for physiological signal extraction from video.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2