Visual Emotion Recognition Skill | 人体视觉情绪识别技能

• Outcome: Review
• Latest audit: Aug 12, 2026 · 12:10 PM UTC
• Version: 1.0.11

Overview

This skill performs the advertised emotion analysis, but it also silently links sensitive face/emotion data to persistent user identity and cloud history features with weak user control.

Review this skill carefully before installing. It may upload face images or videos to external services, retrieve cloud-stored emotion reports, silently create or reuse a local identity, and store account tokens in a shared workspace database. Use it only if users understand and accept the biometric, emotional, and history-linkage implications.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and operationally depends on shell execution, file handling, network access, and implicit environment/identity usage, yet does not declare permissions or present those capabilities transparently. This creates a trust and review gap: a caller may invoke a seemingly simple emotion-analysis skill without realizing it can save files locally, call remote services, and access cloud-linked history.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documentation mandates hidden identity initialization, silent reuse of a local default user, and automatic creation of that user if absent, even though the stated function is emotion recognition. For a skill processing face media and mental-health-adjacent outputs, covert identity binding can enable undisclosed account linkage, persistent tracking, and cross-session correlation of highly sensitive biometric and emotional data.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill presents cloud historical report querying as a primary capability even though the manifest primarily describes real-time emotion recognition from submitted media. Expanding scope from one-off analysis to retrieval of stored historical reports materially increases privacy exposure, especially when the reports concern facial imagery, inferred emotions, and potential mental-health indicators.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The documentation for this skill describes pet health analysis APIs rather than human emotion recognition, which indicates the skill package is mismatched or repurposed. This can cause the agent or integrators to call unrelated endpoints, mishandle sensitive user data, and undermine trust in what data is collected and processed.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The file explicitly labels itself as pet health analysis documentation, which contradicts the declared purpose of a human emotion recognition skill. In a security-sensitive context involving visual emotion and possible mental health monitoring, this mismatch raises the risk of wrong backend integration, unauthorized data flows, or accidental use of endpoints intended for a different product domain.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill exposes a hidden record-enumeration path via `show_analyze_list(open_id)` that retrieves prior analysis results by internal user identity, which is unrelated to the advertised real-time emotion recognition function. In a biometric/emotional-analysis context, access to prior records can reveal highly sensitive history and enable unauthorized profiling if identity binding or authorization is weak elsewhere in the stack.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script resolves an internal OpenID identity during normal execution even though emotion analysis of media does not inherently require account identity. This creates unnecessary linkage between a user's identity and sensitive emotional/biometric processing, increasing privacy risk and enabling account-associated data access paths not obvious from the skill's stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The function `show_analyze_list` exposes a history-listing capability that is not obviously required for the advertised emotion-recognition function, and it relies on an `open_id`-based lookup without any visible authorization checks in this file. In a mental-health/emotion-analysis context, access to historical analysis results can reveal highly sensitive behavioral or psychological inferences, making scope creep significantly more dangerous.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file exposes generic add/edit/delete/list helpers plus raw http_get/http_post/http_put/http_delete wrappers that can send requests to caller-supplied URLs. For a skill whose declared purpose is face emotion recognition, this broad network and CRUD surface is unrelated and enables the skill or dependent code to interact with arbitrary remote services, increasing the risk of data exfiltration, unauthorized API access, or hidden secondary behavior.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The raw HTTP helper methods accept an arbitrary URL and forward arguments directly to the underlying request utility, giving the skill a general outbound networking primitive. In the context of an emotion-recognition skill, this is especially suspicious because it can be used to transmit captured biometric/emotional data to unapproved endpoints or to communicate with attacker-controlled infrastructure.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The get_user_by_username capability performs account lookup functionality that is not justified by the stated emotion-analysis purpose. Even if benignly intended as shared utility code, it expands the skill's access to user-related data and could support user enumeration, privacy violations, or correlation of emotional/biometric outputs with specific identities.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The file includes generic user-account persistence logic, including usernames, real names, emails, birthdays, age, sex, tokens, and open tokens, which is materially unrelated to the stated emotion-recognition capability. In a skill advertised for visual emotion analysis and mental-health monitoring, undisclosed identity and token storage expands the data collection surface and creates privacy and credential-retention risk without clear necessity or user disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The module automatically creates and migrates a local SQLite database in a shared workspace data directory, behavior not disclosed by the skill description. For a mental-health-adjacent emotion-recognition skill, undisclosed local persistence increases the chance of sensitive biometric/behavioral or user-identifying data being retained, shared across contexts, or accessed by other components unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill manifest describes a narrowly scoped emotion-recognition capability, but the implementation exposes a generic `ai_chat(prompt, session_id, timeout)` interface that can be repurposed for arbitrary agent interactions. This scope mismatch weakens trust boundaries and can enable unauthorized or unexpected use of broader LLM/agent functionality than users or policy reviewers would expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility code performs authenticated network actions, token handling, silent account provisioning, and persistence of returned credentials, which is far beyond the declared emotion-recognition purpose of the skill. In this context, hidden identity bootstrapping and outbound API use materially increase the risk of covert data exfiltration, unauthorized account creation, and misuse of the agent's local identity state.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code reads a workspace identity-like file, falls back to local database identities, and auto-generates persistent user identifiers when none exist. For an emotion-recognition skill, this undisclosed identity resolution and persistence is unrelated to core functionality and creates unnecessary tracking and impersonation risk.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The workspace discovery logic inspects environment variables, derives agent/workspace roots from filesystem layout, and creates directories automatically. While not inherently malicious, this broad environment and filesystem awareness exceeds the stated emotion-analysis scope and can facilitate access to broader agent data locations if combined with other features.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases for history lookup are broad and auto-invoked, increasing the chance that an ambiguous user request causes unsolicited cloud report retrieval. In this context, unintended activation could expose sensitive historical emotion-analysis records tied to a user's face media or inferred psychological state.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill handles facial images/videos, infers emotions including depression-related states, and supports cloud history queries, but the description lacks a clear privacy warning or informed-consent notice. Because this is highly sensitive biometric and mental-health-adjacent processing, users may unknowingly submit data to remote analysis and storage without understanding collection, retention, sharing, or risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill enforces internal identity handling and explicitly prevents presenting that choice to the user, removing transparency and opt-in for account linkage. Combined with sensitive face/emotion analysis, this increases the risk of silent profiling, persistent tracking, and unexpected association of reports with a user identity.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The analysis flow sends local media paths or remote media URLs to an external analysis backend through `skill.get_output_analysis(...)` without any user-facing warning or consent step. Because the skill processes faces and inferred emotions, the transmitted data is especially sensitive; silent transmission can expose biometric and mental-health-adjacent information to external services.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script automatically resolves an internal OpenID without a visible warning that identity-linked account data may be accessed or associated with the analysis session. In this context, combining identity with emotion-recognition outputs materially increases sensitivity, since it can tie inferred emotional states to a specific person and account history.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The skill uploads either full local video contents or arbitrary remote video URLs to an external analysis service without any visible consent prompt, disclosure, or minimization. Because the skill processes biometric/emotion data and potentially mental-health-related inferences, silent transfer can expose highly sensitive personal information and create privacy/compliance risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: FileUtil.open() opens arbitrary paths for writing with no confirmation, guardrails, or path restrictions. In an agent skill context, this can enable silent overwrites or creation of files in sensitive workspace locations if upstream inputs are attacker-controlled.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code reads an identity/credential-like value from data/smyx-api-key.txt without user disclosure or consent. Because the skill is presented as emotion recognition, silently consuming local identity material is especially suspicious and can lead to unauthorized account association or downstream transmission.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2