Security audit
Security checks for vulnerabilities and agentic risk
The skill performs focus analysis through a cloud service, but it also handles sensitive face/gaze video data, silently manages user identity, stores tokens locally, and retrieves cloud history with limited user consent controls.
Install only if you are comfortable sending videos or video URLs containing faces, gaze, posture, and attention behavior to the publisher's cloud service. Treat historical report queries as sensitive, and review how the service creates or reuses identities, stores local tokens, and retains cloud reports before using it with students, employees, drivers, or other monitored people.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The analyzed implementation appears to create or resolve user identities, manage local records, and perform authenticated outbound HTTP requests with token handling, none of which are disclosed by the user-facing description. In the context of attention-monitoring video, undisclosed identity binding and authenticated cloud submission significantly elevate privacy, tracking, and misuse risks.
The YARA hit for metadata poisoning is not conclusive on its own, but in this file it coincides with multiple signs of misleading metadata and description/behavior mismatch. If manifest text is crafted to manipulate tool routing or reviewer trust, it can cause the host to invoke a more capable skill than expected or obscure risky behavior.
---
name: "focus-analysis"
description: "Real-time detection of gaze direction and facial pose to quantify states of focus, distraction, or mind-wandering. Suitable for scenarios such as classroom learning, office meetings, and driving attention monitoring. | 专注度分析技能，实时检测视线方向、面部姿态，量化专注/分心/走神状态，适用于课堂学习、办公会议、驾驶专注度监测等场景"
version: "1.0.20"
license: "MIT-0"
---
# 🎯 Concentration Analysis Skill | 专注度分析技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端�
The skill processes highly privacy-sensitive video data involving faces, gaze, posture, and inferred attention states, yet the documentation does not clearly warn that content may be transmitted to cloud services or stored in reports. This deprives users of informed consent in a domain involving biometric-like and behavioral monitoring data.
This file exposes a broad generic network wrapper with create, edit, delete, list, arbitrary GET/POST/PUT/DELETE, and download-URL generation capabilities that are not constrained to the stated focus-analysis purpose. In a skill meant for gaze/focus analysis, such unrestricted remote operations materially expand the attack surface, enabling hidden data exfiltration, unauthorized backend interaction, or repurposing of the skill as a general remote API client if higher-level inputs are attacker-controlled.
The User model stores identity and authentication-related fields including username, realname, email, token, and open_token, which are highly sensitive and not justified by a focus-analysis skill's declared purpose. If this local SQLite database is accessed by other components or compromised, it could expose credentials or session artifacts and enable account takeover or privacy harm.
This utility code performs identity resolution, local user lookup, token recovery, remote login/registration, and credential attachment in a skill advertised for focus analysis. That is a strong scope mismatch and creates hidden account and authentication side effects, enabling undisclosed identity provisioning and outbound authentication flows unrelated to the stated feature.
The code can automatically call a remote health endpoint to register or log in a user using generated or recovered identifiers, despite this having no clear relation to focus analysis. Hidden account creation and remote authentication materially increase privacy and abuse risk, especially if triggered without an informed user action.
The skill requests or implies broad capabilities including shell, network, filesystem, and environment access, but does not declare any explicit tool scope or permissions boundary in the manifest. This creates ambiguity for hosts and reviewers and increases the risk that the skill can perform actions beyond user expectations, especially given its ability to run scripts, read/write files, and contact remote services.
The history-report trigger phrases are broad enough to match ordinary conversation, causing the skill to automatically query cloud-side historical reports when a user may only be asking generally about reports. In a privacy-sensitive context, accidental disclosure or retrieval of prior attention-analysis records is a meaningful risk.
The policy text states that identity parameters must not be shown or requested, but the broader document presents operational guidance and outputs primarily in Chinese without documenting a language choice or opt-in. Because the skill serves general scenarios and is not clearly justified as Chinese-only, this may violate a language/locale choice policy.
The documented endpoints and scenario code are for pet health analysis, which materially contradicts the declared purpose of a focus-analysis skill. This mismatch can mislead integrators, cause unintended data flows to an unrelated backend, and indicates either repurposed code or incorrect packaging, both of which raise supply-chain and privacy concerns.
The script exposes a hidden listing function that retrieves prior focus-analysis records by OpenID, which exceeds the advertised purpose of analyzing a supplied video. Because identity handling is obscured from normal help output and tied to internal user context, this can enable unintended access to historical analysis metadata and creates a privacy-sensitive data enumeration path.
The command description, help text, and user-facing status/error messages are written in Chinese only, forcing a specific language for interaction. Under the policy, locale or language constraints should either be optional, user-selectable, or explicitly justified; this file provides no such choice or justification.
The skill sends user-provided video or URL content to a remote analysis service without any explicit privacy notice, consent prompt, or disclosure that biometric/facial attention data may be processed externally. Given the sensitivity of gaze direction and facial-pose data, silent remote transmission increases the risk of privacy violations, policy noncompliance, and unexpected exposure of personal data.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Detected: suspicious.install_untrusted_source