Concentration Analysis Skill | 专注度分析技能

• Outcome: Review
• Latest audit: Aug 9, 2026 · 6:04 PM UTC
• Version: 1.0.11

Overview

The skill is mostly a real cloud focus-analysis tool, but it quietly creates or reuses identities, stores tokens locally, and can retrieve cloud report history for sensitive video/facial analysis.

Review this skill before installing in environments with private videos, students, employees, drivers, or other identifiable people. It sends video inputs or URLs to a remote service, can query prior cloud reports, silently manages an internal identity, and may store account tokens in a local workspace database. Install only if you are comfortable with that remote processing and identity persistence, and have consent/authorization for the footage being analyzed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill directs the agent to use shell, network, and local file operations, including saving attachments locally and calling Python scripts, but it does not declare those capabilities as permissions. This creates a transparency and governance gap: operators and users cannot accurately assess what the skill may access, and the undeclared network/file behavior increases the chance of unsafe execution in sensitive environments.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documented API endpoints and scenario code describe pet health analysis, which is materially inconsistent with the declared skill purpose of focus/gaze analysis. This kind of capability mismatch is dangerous because it can cause the agent or integrators to invoke unrelated back-end functions, potentially exposing or processing the wrong category of sensitive data and enabling unauthorized use of another service surface.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The CLI performs hidden identity resolution via OpenIdUtil.resolve_current_open_id and exposes a listing mode that retrieves analysis records by open_id, even though this capability is not part of the stated focus-analysis purpose. Hidden account-context behavior increases the risk of unauthorized access to other users' analysis metadata or privacy-sensitive records if identity binding or authorization checks are weak elsewhere.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill exposes report-listing and export-link generation features that are not described in the manifest's stated focus-analysis purpose. Hidden data-access functionality can leak prior analysis records or report URLs to users or callers who did not expect broader retrieval capabilities, especially if authorization is weak elsewhere.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This file exposes generic CRUD and arbitrary HTTP helper methods that can send requests to caller-supplied URLs, which is far broader than the declared focus-analysis purpose. In a skill that may process sensitive attention or facial-pose data, such generic network primitives increase the risk of covert data exfiltration, unauthorized backend access, or repurposing the skill as a general network client.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The http_post/http_put/http_get/http_delete wrappers accept arbitrary URL input and directly invoke network requests with no visible restriction, authentication guard, or destination validation in this file. That makes the component usable as an arbitrary outbound HTTP client, which is especially risky in a focus-analysis skill that could access sensitive user telemetry and send it to unapproved endpoints.

Context-Inappropriate Capability

Medium

• Confidence: 77% confidence
• Finding: The add/edit/delete/list/page methods implement broad record-management behavior that is not obviously required for gaze or focus detection and may indicate a reusable backend access layer embedded in this skill. While not inherently malicious, this expands the operational scope of the skill and can enable misuse of backend resources or movement of unrelated data through the component.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The file defines persistent user-account storage and retrieval logic that appears unrelated to the declared focus-analysis function of gaze and facial-pose assessment. In a privacy-sensitive skill, collecting and persisting identity records beyond the stated purpose increases the attack surface and creates unnecessary retention of user data that could be exposed or misused.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The User model stores personal profile data and authentication-style secrets including token and open_token without any visible encryption, minimization, or purpose limitation tied to focus analysis. If the local SQLite database is accessed by another component or copied from disk, these fields could expose user identities and reusable credentials, making the privacy and account-compromise impact significant.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The utility creates and persists user identities locally, reuses credential-like values from a workspace file, and silently provisions default identities unrelated to gaze/focus analysis. In the context of a focus-analysis skill, this is over-privileged identity handling that can enable undisclosed account binding, tracking, and later authenticated API use without informed user consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The HTTP helper performs remote login/registration, token acquisition, token caching, retry-based reauthentication, and attaches identity tokens to outbound requests by default. That behavior is not justified by the declared purpose of real-time focus analysis and creates a hidden authenticated communications channel that could expose users to undisclosed data transfer and account misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill performs privacy-sensitive monitoring of gaze, head pose, and attention state from uploaded videos or URLs, and the document indicates cloud/API processing, yet it does not present a clear upfront warning about biometric-style inference, surveillance sensitivity, or remote processing. Users may submit third-party videos or recordings without informed consent, creating substantial privacy, compliance, and misuse risk.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The default trigger activates whenever a user provides a monitoring video URL or file for attention analysis, which is broad enough to fire without a strong confirmation boundary. In a surveillance-oriented skill, unintended activation can lead to analysis of sensitive footage and transmission of data to backend services without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The history-report trigger phrases include common wording like 'history report' and 'report list,' which can collide with ordinary user requests and automatically invoke cloud report retrieval. Because report history is tied to internally managed identity and may expose prior analyses, ambiguous triggering can cause unauthorized or accidental disclosure of sensitive historical monitoring data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool sends user-supplied local video paths or remote URLs to an external analysis service without a clear, user-facing warning or consent step at the point of transmission. Because video content for gaze/facial-pose analysis is highly sensitive biometric and behavioral data, silent exfiltration to a remote API creates meaningful privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script accepts a hidden `--api-key` argument using `argparse.SUPPRESS`, which conceals from normal help output that credentials may be supplied to the tool. In a skill that uploads or analyzes local video/URL content via remote services, this lack of disclosure reduces informed consent and can cause users or integrators to pass sensitive credentials without realizing they are being handled or potentially transmitted during analysis.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The method logs the full prompt content in debug output, which can expose sensitive user data, system prompts, or proprietary inputs to logs, consoles, or centralized log collectors. In an agent skill context, prompts often contain secrets or personal data, so debug logging increases the chance of unintended disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This request path automatically injects username/open-id and multiple authentication headers into outbound requests without any user-facing disclosure or confirmation. Even if the transport is HTTPS-capable, the undisclosed transmission of identity and token material is a privacy and security concern, especially for a skill whose stated function does not imply account synchronization.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code reads a sensitive workspace file containing an API key or identity value and uses it as an internal open-id without notifying the user. Silent consumption of local credential material increases the risk of unintended cross-skill identity reuse and hidden coupling between local secrets and remote account actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB，建议视频时长不少于 5 分钟以反映真实专注度变化 |
| 🔎 使用提醒 | 不同场景默认判定标准有差异，可通过参数调整阈值 |
| 🧑‍⚖️ 结果性质 | 分析结果仅供参考，不能替代人工评估，具体改善方案请结合实际情况调整 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 84% confidence
• Finding: ‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "focus-analysis"
description: "Real-time detection of gaze direction and facial pose to quantify states of focus, distraction, or mind-wandering. Suitable for scenarios such as classroom learning, office meetings, and driving attention monitoring. | 专注度分析技能，实时检测视线方向、面部姿态，量化专注/分心/走神状态，适用于课堂学习、办公会议、驾驶专注度监测等场景"
version: "1.0.13"
license: "MIT-0"
---

• Confidence: 88% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2