Elderly Tachypnea / Dyspnea Detection | 老年人呼吸急促/困难识别

• Outcome: Review
• Latest audit: Aug 29, 2026 · 10:21 AM UTC
• Version: 1.0.10

Overview

This skill has a coherent health-video analysis purpose, but it also silently manages identities, stores tokens, and retrieves cloud health-report history with weak user control.

Review this skill before installing. It may send private bedroom video to a remote service, retrieve cloud health-report history, silently create or reuse an identity, and store authentication tokens locally. Use it only where the monitored person has consented, the backend endpoint is trusted, and shared-workspace identity reuse is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 84% confidence
• Finding: This code applies filters using getattr(self.__model__, key) where keys come from the caller-supplied filters dictionary. An attacker who can control filter keys may trigger access to unintended model attributes, cause exceptions for invalid fields, or query on columns that should not be exposed, creating an authorization and data exposure risk in a generic DAO.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 84% confidence
• Finding: Like the list() method, count() accepts arbitrary filter keys and resolves them dynamically on the ORM model. In a shared DAO, this can enable probing of model structure, unauthorized filtering on sensitive fields, and denial-of-service via repeated invalid queries if upstream callers pass attacker-controlled keys.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises capabilities that include shell, network, file read/write, and environment access, but it declares no permissions or corresponding safeguards. In a privacy-sensitive healthcare context, this mismatch can mislead operators about the true execution surface and enable unreviewed access to local files, network resources, and cloud endpoints.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest presents a visual respiratory analysis function, but the body of the skill expands behavior to cloud history lookup, proactive alerts, and report-link retrieval. This scope drift increases the chance that users or reviewers consent to one function while the skill performs additional remote data access and disclosure operations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill introduces automatic cloud history-query behavior triggered by broad phrases, despite the main purpose being respiratory video analysis. In a medical-monitoring setting, this can expose sensitive historical reports without clear user intent, especially because the query is mandatory and routed to a cloud API.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documented behavior to silently reuse or create a local default user identity is unrelated to the core task of computing respiratory rate from video. This can cause cross-user data mixing, unauthorized access to another person's medical report history, and persistent identity state without informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill exposes a function to list prior analysis records by open_id, which goes beyond the stated purpose of analyzing a single video. In a health-monitoring context, prior respiratory analyses are sensitive medical-adjacent records, and exposing history retrieval without clear authorization checks creates a privacy and data-minimization risk.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The CLI contains hidden identity-related parameters and resolves an internal user identity without transparent user-facing documentation. Hidden per-user record access paths are dangerous because they can enable unauthorized access patterns, make security review harder, and conceal privacy-sensitive behavior in a tool handling elderly health-monitoring data.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill accepts arbitrary http/https video URLs and forwards them for analysis, which expands the trust boundary beyond a fixed local bedroom camera workflow. In a healthcare-monitoring context, this can enable analysis of untrusted remote content, create privacy/compliance issues, and potentially allow misuse of backend fetch behavior contrary to the declared skill purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script exposes a `--list` mode that calls `skill.get_output_analysis_list(open_id=open_id)`, which is outside the narrowly described purpose of analyzing a single bedroom-camera respiratory video. In a health-monitoring context, a history-listing feature can reveal prior analyses and potentially sensitive medical-related records, expanding data access beyond what users would expect from this skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The function accepts an arbitrary `url` and then passes it to backend analysis as if it were normal input, even though the manifest describes a fixed bedroom camera scenario. This broadens the skill into remote-content ingestion, which can enable analysis of unintended third-party videos, privacy boundary violations, and possible backend abuse depending on how remote URLs are fetched downstream.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file exposes broad generic network and CRUD helper methods that can call arbitrary URLs and perform remote modification, which is far wider than the skill’s stated purpose of analyzing breathing rate from a bedroom camera. In a health-monitoring context, this creates unnecessary capability to transmit sensitive elder data or interact with unrelated services, increasing the blast radius if the skill or its callers are misused or compromised.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The http_post/http_put/http_get/http_delete wrappers accept caller-supplied URLs and arguments, effectively giving the skill arbitrary outbound network capability. For a skill whose manifest describes local respiratory-rate analysis and alerting, this is unjustified and dangerous because it could be used to exfiltrate sensitive camera-derived health data or contact attacker-controlled infrastructure.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The generic add, edit, and delete methods provide remote state-changing operations without any visible restriction tying them to the medical monitoring use case. Even if intended as convenience helpers, they enable unnecessary modification actions that expand risk beyond analysis-only behavior and could be abused to alter or delete remote records.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file defines persistent user-account storage and mutation logic, including username/realname lookup and default-user selection, which is unrelated to bedside respiratory-rate analysis. In this skill context, such identity handling broadens the data collection surface and increases privacy risk without clear functional justification.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module performs generic database path rewriting, database creation, schema migration, and reusable CRUD for arbitrary tables, which is much broader than the manifest's analytics-and-alert purpose. In a bedroom-camera elderly monitoring context, unnecessary persistent storage and cross-skill shared data handling increase privacy and misuse risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores token and open_token values even though the skill is described as local camera-based respiratory monitoring for elderly users. Retaining authentication-like secrets in a local shared SQLite database creates a severe confidentiality risk: compromise of the host or another component could expose reusable credentials unrelated to the skill's clinical function.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs remote account provisioning, login, token retrieval, and local token persistence that are unrelated to the declared bedside respiratory-rate analysis function. This creates an unnecessary identity and network side channel: simply using the skill can trigger remote account creation and credential handling, expanding data exposure and attack surface well beyond what users would reasonably expect from a monitoring skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code inspects agent workspace layout, reads shared workspace data, accesses data/smyx-api-key.txt, and creates or reuses local user identities across agent contexts. For a respiratory monitoring skill, this is over-privileged behavior that can expose cross-agent secrets or identities and weakens isolation between skills and agents.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default trigger activates on essentially any uploaded resting chest/abdomen monitoring video, which is too broad for a sensitive medical-analysis skill. Overbroad activation can cause unintended processing of private bedroom footage and unnecessary transmission or storage of health-related media.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Keyword-based activation includes broad symptom and disease terms like chest tightness, pneumonia, heart failure, and COPD, which may appear in general conversation rather than a request to analyze video. This can accidentally invoke a high-sensitivity medical workflow and expand processing beyond what the user intended.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Automatic history-report query triggers rely on broad natural-language phrases that can easily match ordinary requests to discuss or summarize prior results. Because the action retrieves cloud-stored health records, accidental invocation can disclose sensitive medical history and report links without sufficiently clear authorization.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code reads the entire local video file and uploads it to the analysis service without any consent prompt, disclosure, minimization, or visible privacy guardrails in this component. Because the content is bedroom video of elderly individuals, the data is highly sensitive and the privacy risk is materially elevated if users do not clearly understand that raw footage is being transmitted off-device.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The hidden `--api-key` parameter is intentionally suppressed from help output, reducing transparency around credential handling. In a medical-video analysis workflow, undisclosed credential parameters make it easier for operators to misuse secrets, pass them insecurely on the command line, or be unaware that authentication material is involved at all.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script initiates analysis of local video files or URLs by calling a backend-facing skill method without any user-facing disclosure that sensitive bedroom footage may be transmitted off-device. Because the content involves elderly subjects in private sleeping areas and potentially health-related inference, silent network transmission materially increases privacy and compliance risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2