Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because scanners report a mismatch with its neonatal screening purpose, risky account and credential handling, and workflows that may process infant images remotely without clear consent.
Consider not installing until the account and credential handling, remote image processing and consent, and environment-only behavior are clarified. Scanning was partial because a referenced local path was missing, so the evidence does not cover that reference.
scripts/smyx_neonatal_jaundice_screening_analysis.pyDefault CLI identity initialization discards the trusted sender identity and reuses a shared account
A different user of the same agent can receive previously stored neonatal screening results and report links belonging to the fallback account.
The visible implementation does not perform the declared neonatal jaundice screening workflow and instead consists of generic skill scaffolding and a disabled agent-chat helper. No external command is actually executed. The imported base classes and API service are not supplied, so their behavior cannot be established; the assessment is limited to this code chunk.
The supplied code's substantive purpose is generic user-account database management, not neonatal jaundice assessment. Database access could support a medical application, but this chunk specifically manages identities and tokens without any visible connection to newborn images, clinical measurements, or risk results. These account-management capabilities are not represented in the declared description. This assessment is limited to the supplied chunk; it does not establish what other skill files implement or indicate malicious behavior.
Generic string, date, file, and HTTP helpers could support the declared workflow and are not inherently mismatches. However, this chunk additionally implements an undeclared account, credential, and billing integration: it can call /sys/phoneLogin with registration enabled, persist user credentials, and attach authentication headers to arbitrary supplied HTTP(S) destinations. These behaviors materially exceed the stated image-based jaundice-screening purpose. No camera capture, image analysis, bilirubin estimation, or risk classification appears in this chunk; other files could contain those functions, but that would not negate the additional behaviors shown here. The payment instructions are assessed as returned program content, not followed.
HTTP requests and download helpers could legitimately support the declared skill and are not inherently mismatches. However, this chunk exposes a broader API-management interface, including an explicit user-account lookup capability not explained by the description. No neonatal-analysis workflow is demonstrated. This assessment is limited to the supplied chunk: it does not establish that these methods are invoked, that data is exfiltrated, or that the larger skill lacks the advertised analysis.
The supplied code is presented and implemented as a video-analysis and history-retrieval tool, rather than an explicit neonatal jaundice screening workflow. It contains no visible camera capture, facial or scleral detection, skin-color measurement, bilirubin estimation, or low/medium/high risk classification. Those clinical functions could exist in the imported skill implementation, which was not supplied, so their absence here alone is not conclusive. However, the explicit user-linked history-listing capability is outside the declared purpose, and the visible analysis interface does not establish the claimed specialized behavior.
The supplied code implements a general analysis-service client whose inputs and outputs are framed around videos and generic reports. It contains no visible task configuration or processing connecting that service to the declared neonatal jaundice assessment. Uploading media and polling could support the declared purpose, so those implementation details are not independently suspicious. However, the visible workflow does not substantiate the specialized behavior described. Imported service implementations are not supplied, so jaundice-specific processing in those components cannot be ruled out.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "smyx-neonatal-jaundice-screening-analysis"
description: "Using a neonatal monitor or baby camera, the system captures high-resolution facial images of the newborn and uses AI visual analysis to detect sclera color (white in normal babies, yellow when jaundiced) and facial skin yellowness index (based on skin-color chromatic spaces, e.g., mapping the skin region to estimated clinical bilirubin levels). It outputs a jaundice-risk hint (low / medium / high risk). | 通过新生儿监护器或婴儿摄像头拍摄新生儿面部高清图像，利用AI视觉分析技术检测巩膜（眼白）的颜色（正常白色，黄疸时呈黄色）
The helper accepts arbitrary absolute HTTP or HTTPS URLs but adds service tokens, the API key, and user identity without checking the destination. If an attacker can influence a caller's URL, credentials can be sent directly to an attacker-controlled host; allowing HTTP also exposes them to network interception.
Without declared permissions the skill's intent is opaque and cannot be validated.
The default trigger treats a request to analyze a newborn's facial image as authorization for jaundice screening, even when the user's intended analysis may be unrelated. In this cloud-backed medical workflow, that can initiate sensitive infant-image processing and health inference without specific authorization.
Although the notes require guardian consent and acknowledge sensitive images, the execution workflow does not explicitly disclose that local images are uploaded for remote processing and associated with cloud reports. Generic privacy language and references to an API do not ensure informed consent to transferring identifiable infant health data.
The parser advertises an environment-only mode that will not analyze input, but the parsed flag is never checked. With an input supplied, execution still initializes identity and invokes analysis, potentially uploading sensitive newborn imagery despite the caller's explicit non-analysis selection.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = result_json_common_ai_response
result_json_health_ai_response = result_json.get("healthAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_health_ai_response:
result_json = result_json_health_ai_response
The code reads a local file into memory and passes its contents to the remote analysis interface without a visible disclosure or consent gate. For newborn facial imagery, users expecting local processing could unintentionally transfer identifiable and medically sensitive data to an external processor.
The --export-env-only option is accepted but never used to change execution, so supplying media still runs the normal analysis workflow. In this skill's context, callers attempting a non-analysis operation can inadvertently initiate remote processing of sensitive infant media.
The user model stores reusable token and open_token values as ordinary strings in a shared SQLite database, alongside identifying information. No credential encryption or restrictive file permissions are established here, so another process or skill with database access could recover credentials; neonatal screening makes unnecessary identity retention particularly sensitive, although account support is not inherently malicious.
The agent invocation is commented out, and accessing stderr on an empty dictionary raises an exception that is swallowed, leaving callers with None instead of analysis or an explicit failure. If this helper is used for neonatal screening, that silent failure can conceal unavailable analysis and delay appropriate follow-up; the supplied source does not establish whether the screening path actually calls it.
The generically named open helper always opens paths in write mode, immediately erasing existing contents. There is no confirmation, explanatory comment or docstring, or user-facing notice describing this behavior; exception tracing does not disclose successful truncation.
An ordinary HTTP request can trigger a separate remote login or registration with silent and register enabled, then persist returned account details and authentication tokens. This hidden side effect transmits and retains identity data without an explicit enrollment boundary, which is particularly concerning in a newborn-health workflow.
The helper submits the current identity as both openId and mobile while explicitly requesting silent login or registration. This is an undisclosed account-management side effect of transport code, not a necessary consequence of sending a screening request, and can link sensitive health-service usage to a persistent identity.
This POST transmits a user identifier and source metadata to the configured account service as part of automatic registration. External transmission alone is not malicious, but the surrounding silent enrollment behavior lacks an explicit consent boundary; this request does not itself show transmission of newborn images or screening results.
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
}
try:
_response = requests.post(_url, json=_data)
if _response.status_code == 200:
_response_json = _response.json()
if _response_json and _response_json.get("success"):
YamlUtil.load creates parent directories and writes a YAML file when the requested configuration is missing, without a prompt, log, docstring, or explanatory comment. Because BaseEnum.init_subclass calls this loader (L044–L059), importing the module can modify the filesystem even when the caller only expects to read configuration.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
username = getattr(model, "username", None)
if username:
column_names = self.__model__.__table__.columns.keys()
update_data = {key: getattr(model, key) for key in column_names if key != "username"}
return self.update_by_username(username, **update_data)
return None
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
column_names = self.__model__.__table__.columns.keys()
for key in column_names:
value = getattr(model, key)
setattr(instance, key, value)
session.commit()