Security audit

Adult Facial HRV Trend Monitoring (rPPG) | 成人心率变异性（HRV）趋势监测（面部）

Security checks across malware telemetry and agentic risk

Overview

The skill does HRV analysis through a remote backend, but it also silently creates or reuses persistent identities and stores account tokens for sensitive facial health data without clear user control.

Install only if users understand that facial videos and HRV results may be sent to a remote backend, linked to an automatically created or reused identity, and persisted locally with account tokens. Review or change the backend configuration first, especially the private-network dev URLs, and require explicit user consent before analysis or history lookup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises significant capabilities—environment access, file read/write, network access, and shell execution—without declaring permissions or clearly warning users. That creates a transparency and consent problem: a user may believe they are invoking a simple local HRV analysis, while the skill can access local resources and communicate externally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose is local-seeming facial HRV computation, but the behavior extends to uploading videos or URLs to remote backends, querying historical records, creating/resolving user identities, authenticating to remote services, and storing reusable tokens locally. This mismatch is dangerous because it hides materially different data flows and account behaviors, especially for biometric/health-related video and persistent user tracking.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Cloud-based historical report querying and report-link retrieval go beyond the narrow task of computing HRV from a short input video. This broadens the attack and privacy surface by enabling retrieval of potentially sensitive prior health reports and external links, increasing the chance of unintended disclosure or access to unrelated user data.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Silently auto-associating a user identity or creating a default local user for health-report operations is risky because it can bind sensitive biometric and wellness records to an implicit account without informed consent. In a multi-user or shared-device environment, this can cause cross-user data exposure, unauthorized record linkage, or accidental access to another person's historical reports.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a human facial HRV analysis tool, but it exposes unrelated pet-type switching that changes global behavior via ConstantEnum.DEFAULT__PET_TYPE. This mismatch is dangerous because it indicates hidden or repurposed functionality not disclosed to users, increasing the risk of incorrect routing, policy bypass, or sending sensitive biometric data into an unintended processing path.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code imports and uses an internal OpenID identity mechanism even though the described task is local facial HRV analysis. Hidden identity binding around biometric processing is sensitive because it can silently associate health-related outputs with a user account, enabling tracking, profiling, or unauthorized access to personal trend data.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill includes list retrieval of account-scoped analysis history, which is not described in the manifest for a facial HRV analysis tool. Undisclosed history access is risky in this context because HRV trends are health-adjacent biometric data, and exposing retrieval behavior can reveal prior records tied to a user identity without clear user expectation or consent.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them for analysis, which expands the trust boundary beyond local camera recordings described in the manifest. This can enable server-side fetching of attacker-controlled URLs, creating privacy, compliance, and potential SSRF-style risk depending on how downstream services retrieve the resource.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill exposes report-history listing and constructs export links unrelated to the stated single-video HRV analysis function. This broadens access to prior analysis artifacts and could leak sensitive health-related reports if access control is weak elsewhere, especially since the code comments show the open_id check was intentionally disabled.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The script includes a `--list` path that retrieves prior analysis history via `skill.get_output_analysis_list(open_id=open_id)`, which expands the capability from single-video HRV analysis into access to historical user data. In a health-related skill, exposing history retrieval without clear purpose limitation, disclosure, or visible authorization checks increases privacy risk and can enable unintended access to sensitive biometric analysis records.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code resolves and uses an `open_id` to fetch user-specific analysis history, but this file shows no local validation that the caller is entitled to access that identity's records. Because the skill processes health-adjacent biometric outputs, misuse of an account identifier can expose sensitive historical data if upstream authorization is weak or misconfigured.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This file implements a general-purpose API client with pagination, CRUD-style operations, and arbitrary GET/POST/PUT/DELETE wrappers, which substantially exceeds the skill’s stated purpose of facial-video HRV analysis. In a skill that processes sensitive biometric/health-related data, exposing broad network primitives increases the chance of unreviewed data exfiltration, unauthorized backend access, or capability creep through other components that call these methods.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The add, edit, delete, and generic HTTP mutation helpers provide remote modification capability unrelated to the narrow analytics use case described in the manifest. If reachable by other parts of the skill or a plugin pipeline, these methods could be used to alter remote resources or transmit sensitive user data without clear justification, which is especially risky in a health-monitoring context.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: This skill is described as facial HRV analysis, yet the file defines persistent local user-account storage and mutation logic unrelated to that purpose. Unnecessary identity persistence increases data-collection scope and creates avoidable privacy and security risk, especially in a health-adjacent skill handling potentially sensitive user context.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The model stores token and open_token fields alongside user identity attributes without any justification tied to facial HRV processing. Storing authentication-like tokens in a local SQLite database broadens compromise impact: theft of the DB can expose account/session secrets in addition to personal data, which is especially concerning in a health-monitoring context.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This shared utility layer performs broad tokenized HTTP access, account lookup/provisioning, and identity propagation that are not justified by the stated facial-video HRV analysis purpose. The mismatch in scope is dangerous because it silently expands the skill from local health analysis into remote account-linked service interaction, increasing privacy risk, credential exposure, and unauthorized data transmission.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code resolves, creates, and persists user identities automatically by reading a workspace file, reusing local database records, or generating a new default identifier. For a camera-based HRV analysis skill, silently assigning persistent identities creates unjustified tracking and enables correlation of health-related activity with a durable account identifier without clear user approval.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The utility includes billing and recharge workflow handling unrelated to HRV analysis, indicating hidden coupling to monetized backend services. This broadens the trust boundary and may steer users into account/payment flows they did not expect when using a physiological monitoring skill.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases for history lookup are broad and can cause the skill to automatically invoke cloud report-query behavior when the user may only be asking general questions. That raises the risk of over-collection, unintended network access, and disclosure of sensitive historical health records without sufficiently specific user intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script resolves a current internal OpenID while suppressing the related CLI argument from help text, creating hidden identity access. In a biometric/health-monitoring skill, concealed identity resolution is especially dangerous because users may believe analysis is local or anonymous when it can actually be linked to an internal account and used to fetch or store personal data.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The script accepts remote video URLs without clearly warning that external retrieval or transmission may occur. Because the input is facial video used for HRV extraction, this can expose highly sensitive biometric data to third-party hosts or backend services, creating privacy, compliance, and SSRF-like risk depending on how downstream retrieval is implemented.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The code reads the entire local video file into memory and uploads it for analysis without any visible consent, disclosure, or privacy warning in this component. Because the content is biometric/health-adjacent facial video, silent transmission increases privacy and compliance risk even if the upload is functionally expected.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The DAO automatically creates a local database and initializes schema on construction without any user-facing disclosure or explicit consent. In a skill centered on biometric/health-related analysis, silent persistence is more sensitive than usual because users may not expect durable storage to occur merely by invoking analysis functionality.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The code performs automatic schema migration with ALTER TABLE during initialization and does so silently. Although not an exploit primitive by itself, undisclosed mutation of local persisted state is risky in a biometric/health-monitoring skill because it can expand retained personal data over time without meaningful user awareness or consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code reads an internal identity value from data/smyx-api-key.txt with no user-facing notice in this file. Using workspace-resident identity material silently can expose users to undisclosed account linkage, especially in a health-oriented skill where data sensitivity is elevated.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2