Security audit

Elderly Hand Resting-Tremor Detection | 老年人手部震颤（静止性）识别

Security checks across malware telemetry and agentic risk

Overview

This health-video analysis skill appears purpose-related, but it automatically uploads sensitive videos, creates or reuses identities, retrieves report history, and stores account tokens locally with limited user control.

Install only if you are comfortable sending elderly hand videos or video URLs to the configured analysis service and having the skill create or reuse a local identity. Confirm the API endpoints are production-appropriate, obtain consent from the person recorded, and treat the workspace data directory and SQLite database as sensitive because they may contain report history, profile data, and tokens.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)
Confidence: 78% confidence
Finding: This method applies filters using attacker-influenced keys via getattr(self.__model__, key). While this is not classic SQL injection, untrusted callers can select arbitrary mapped columns and potentially bypass intended access restrictions, enumerate records by sensitive fields, or trigger errors for unexpected attributes. In a shared DAO used across skills, that increases the chance of unauthorized data access patterns.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) return query.scalar() finally:
Confidence: 78% confidence
Finding: The count() helper also accepts arbitrary filter keys and resolves them dynamically on the model. Even though SQLAlchemy parameterizes values, exposing unrestricted column selection can leak metadata about sensitive records through counting and can undermine intended query constraints.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises no explicit permissions, yet the manifest directs behavior that uses shell execution, network access, local file reads/writes, and environment-backed execution. This creates a transparency and consent gap: operators may trust the skill as a simple video-analysis tool while it can also persist data locally and communicate with remote services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose is tremor analysis, but the skill also performs identity management, local user creation/reuse, history retrieval, workspace-file reading, and remote account/token operations. That mismatch is dangerous because it hides materially different handling of sensitive medical data and identities behind a seemingly narrow diagnostic-assist workflow.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Cloud history-report lookup and report-link retrieval extend the skill from single-input analysis into medical record access. In a health context, broad retrieval of prior reports can expose sensitive patient history beyond the immediate task and increases the blast radius if the skill is misused or triggered unintentionally.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Automatic local user reuse/creation adds hidden identity-management behavior that is not necessary for core tremor detection. In a medical-monitoring setting, silently creating or reusing identities can mis-associate reports, enable cross-user data exposure, and persist personally sensitive information without informed consent.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The manifest frames the tool as fixed-camera resting-hand video analysis, but the workflow broadens inputs to images, generic local files, network URLs, and cloud services. This expansion increases attack surface, including arbitrary remote content ingestion and accidental processing of unrelated sensitive files.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The `show_analyze_list` function exposes retrieval of prior analysis results tied to an internal user identity, which exceeds the manifest-described purpose of analyzing a single tremor video. In a health-related context, this creates unnecessary access to historical, potentially sensitive medical inferences and increases the risk of cross-user data exposure if identity resolution or authorization is weak elsewhere in the stack.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: Resolving and using an internal OpenID-style identity is not obviously necessary for local or URL-based tremor detection and introduces user-tracking and data-binding behavior beyond the stated function. In a medical-screening skill, associating results with a persistent identity increases privacy sensitivity and can enable unauthorized correlation of health data if mishandled.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them to the backend analysis service, which expands the data intake beyond the stated fixed-home-camera/local-recording workflow. In a health-monitoring context, this can enable unintended ingestion of third-party or externally hosted sensitive videos, increasing privacy, consent, and policy-bypass risk.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The report-history listing function exposes prior analysis records, which is broader than the declared single-purpose tremor-analysis behavior. In a medical setting, listing historical reports can reveal sensitive health metadata or outputs if authorization boundaries are weak or the capability is invoked unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The code constructs export links for report images, adding a report-export capability beyond basic tremor detection. Exportable medical analysis artifacts can increase leakage risk if links are guessable, shared unintentionally, or exposed without strong access controls.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The script exposes a history-listing function via `show_analyze_list(open_id, ...)` and `--list`, which goes beyond the stated purpose of analyzing a single tremor video. In a health-related skill, this expands access to potentially sensitive prior analysis records and increases the privacy risk surface, especially if users do not expect record enumeration functionality.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code resolves and uses `open_id` even though identity linkage is not justified by the advertised single-video analysis workflow. For a medical-screening-adjacent skill processing elderly health videos, unnecessary identity binding can enable tracking, correlation of health inferences to a person, and broader privacy exposure if backend access controls are weak.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: This service exposes generic CRUD and arbitrary HTTP wrapper methods that are broader than the stated purpose of tremor-video analysis. In a health-related skill handling potentially sensitive elder data, these capabilities increase the attack surface and enable unintended outbound requests or remote data operations if other components pass attacker-controlled URLs or payloads.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This skill is for hand-tremor video analysis, but the shared DAO defines and manages a sys_user table containing identity data. Collecting and persisting unrelated user identity information expands the data footprint without clear necessity, violating data minimization and increasing harm if the local database is accessed by other components or compromised.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The model stores authentication tokens, open tokens, names, email, birthday, age, and sex despite the skill's medical-screening purpose not requiring such credentials in this file. Storing authentication material and sensitive personal data in a local SQLite database materially raises privacy and account-compromise risk, especially in a shared workspace data directory accessible across skills or agents.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file contains shared utility logic for remote authentication, token handling, account provisioning, and API-backed request dispatch that is unrelated to the stated purpose of local hand-tremor video analysis. In this context, hidden network-capable identity management broadens the attack surface and enables undisclosed data or credential transmission to external services.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code reads identity material from a workspace file, falls back to local database records, and can generate and persist default user identities automatically. For a medical-screening-adjacent tremor analysis skill, silent identity initialization and account reuse are not justified and could lead to unauthorized tracking, impersonation, or hidden linkage of user activity across runs.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The utility discovers agent workspace roots from environment variables and file paths, then creates shared data and skills directories. While not directly exploitable on its own, this exceeds the needs of simple tremor detection and increases the skill's ability to inspect and modify broader workspace state than users would expect.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The default trigger is broad enough to auto-run on any uploaded elderly hand-rest video request, which can cause unintended processing of sensitive health-related media. Automatic invocation is especially risky in medical contexts because users may not realize analysis, local saving, or remote submission will occur.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The history-report keywords are broad and tied to medical report retrieval, allowing automatic access to sensitive records based on loose phrasing. In context, this raises privacy risk because historical neurological reports may be exposed without sufficiently deliberate user authorization.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill states that uploaded attachments are automatically saved locally but does not surface this prominently as a user-facing warning. Because the data includes health-related videos, undisclosed local persistence creates privacy, retention, and compliance risks if files remain on disk or are accessible to other processes/users.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill reads local video files and submits their contents to an analysis service without any visible user-facing notice, consent check, or disclosure in this code path. Because the content concerns an elderly person's health condition, undisclosed transmission of sensitive biometric/medical-adjacent data materially increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Remote video URLs are passed directly to the analysis service without any user-facing warning that external network resources will be accessed and analyzed. In this healthcare-related context, that can lead to silent processing of sensitive or non-consensual content and obscures where data is sourced from and sent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2