Security audit

Elderly Tachypnea / Dyspnea Detection | 老年人呼吸急促/困难识别

Security checks for vulnerabilities and agentic risk

Overview

This skill is a cloud-backed health-video analysis wrapper that handles sensitive bedroom footage and silently creates or reuses local identity tokens, so it needs careful review before use.

Install only if you intentionally want elderly bedroom video or URLs sent to the configured LifeEmergence cloud services and you accept automatic local identity/token storage. Obtain consent from the monitored person or caregiver, treat outputs as non-diagnostic screening only, and review or clear the workspace data database/tokens if you stop using the skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (59)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a bedside respiratory-monitoring function for elderly care, but the detected behavior is generic API orchestration, identity handling, history retrieval, and local persistence with no visible implementation of respiratory-rate computation or tachypnea thresholding. In a health-monitoring context, this mismatch is dangerous because operators may trust outputs as medically meaningful while the skill may only relay or format backend results, obscuring actual data handling and creating false confidence in safety-critical alerts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file implements a generic API wrapper with broad CRUD and arbitrary HTTP methods that exceed the declared purpose of a bedside respiratory-rate analysis skill. In a skill handling sensitive elderly monitoring context, such excess capability increases the risk of hidden data exfiltration, unauthorized remote actions, or later abuse by other components that import this service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The arbitrary remote request helpers permit callers to send requests to attacker-controlled or unexpected endpoints, which is unjustified for a fixed-function respiratory monitoring skill. In this healthcare-adjacent setting, that capability could be used to exfiltrate camera-derived data, metadata, or user identifiers, or to pivot into SSRF-style access depending on RequestUtil behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This utility module contains broad identity management, token handling, workspace inspection, and authenticated remote API capabilities that are unrelated to a bedside camera tachypnea-detection skill. That mismatch is dangerous because it expands the skill's privilege and data-exfiltration surface far beyond what users would reasonably expect from respiratory-rate analysis, enabling hidden account actions and outbound data transfer.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code resolves or creates platform identities, reads an identity value from workspace storage, and persists or reuses user records for future authenticated activity. For a camera-based breathing analysis skill, this is unjustified capability creep that could silently bind the skill to a user identity and facilitate unauthorized account use or later remote actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This generic HTTP client can send arbitrary request data plus authentication headers, and it includes logic to recover tokens and retry authorization automatically. In the context of a health-monitoring camera skill, such broad network capability is disproportionate and increases the risk of stealthy data exfiltration, remote account operations, and abuse of stored credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This block automatically sends identity-related fields such as openId and mobile to a remote phone-login endpoint, with silent/register flags, and does so without any visible disclosure in normal operation. In a health camera skill, covert login/registration behavior is especially concerning because it combines sensitive health context with hidden account creation or association.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation instructs use of shell, network, local file, and environment-backed capabilities, but the manifest does not declare any corresponding tool scope or permissions boundary. This creates an undeclared capability surface where an agent may execute sensitive actions without explicit review, increasing the risk of overreach, data leakage, or unsafe execution paths.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation broadens the scope from respiratory-rate estimation to dyspnea recognition and diagnostic-style outputs, which are more clinically sensitive claims than the manifest describes. In an elderly-care setting, this can mislead users into treating the skill as a diagnostic or triage tool without sufficient validation, increasing the chance of harmful reliance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill presentation and operational instructions are primarily in Chinese and describe fixed output conventions, but do not state that the user may choose their preferred language or locale. Because locale/language constraints should be opt-in or clearly justified, this can violate language-choice policy expectations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill says it must not provide medical diagnosis or clinical advice, but elsewhere it promises suggestions and report-query features that resemble diagnostic support. This inconsistency can cause the agent to cross safety boundaries and present medical-seeming guidance in a context involving vulnerable elderly users.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The default trigger condition is broad enough that the skill may activate whenever a user supplies a seemingly relevant video, even without clear intent to run this specific workflow. Over-broad auto-invocation is risky here because it can cause unintended processing, upload, or storage of sensitive bedroom footage.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The keyword triggers include broad medical terms such as chest tightness, pneumonia warning signs, heart failure, and COPD, which can activate the skill outside its stated narrow use case. In a safety-sensitive health context, this increases the chance of routing unrelated medical concerns into an unvalidated visual-monitoring workflow and generating misleading outputs.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2