Back to skill

Security audit

Neonatal Jaundice Screening (Facial Skin Color) | 新生儿黄疸筛查(面部皮肤颜色)

Security checks across malware telemetry and agentic risk

Overview

This skill has a real neonatal screening purpose, but it also sends sensitive infant media and identifiers to cloud services while silently creating and persisting account credentials.

Install only if you are comfortable sending newborn face images/videos, related metadata, and account identifiers to the LifeEmergence cloud service, and with the skill creating local identity/token records for future report history lookup. Obtain guardian consent and treat outputs as non-diagnostic screening hints that require clinical bilirubin confirmation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
84% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The manifest advertises a simple screening skill, but the documented workflow invokes shell commands, reads and writes local files, uses environment-backed identity handling, and calls remote APIs without declaring permissions. That gap prevents meaningful consent and review, and it is especially sensitive here because the data includes newborn facial media and medical-report metadata.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill claims jaundice image screening, but the behavior also includes hidden account bootstrap, token retrieval, cloud history lookup, report-link generation, and broad media handling delegated to a remote API. This mismatch can mislead users and reviewers about data flows and privileges, enabling undisclosed collection or access to sensitive infant medical data under the guise of image analysis.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The documentation implies local AI screening, but the operational steps center on sending inputs to cloud services and retrieving cloud-hosted reports. For highly sensitive newborn health images, this deception materially changes the privacy and security posture because users may believe data remains on-device when it is actually transmitted and stored remotely.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
Historical report lookup and report-link retrieval extend the skill beyond immediate screening into access to previously stored medical records. In this context, hidden or automatic retrieval increases the risk of unauthorized disclosure of infant health history, especially when coupled with implicit identity reuse and cloud-side account association.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill advertises neonatal jaundice screening but delegates to a generic analysis/listing interface without any visible newborn-specific validation, modality checks, or medical-safety guardrails. In a medical screening context, this mismatch can produce misleading risk outputs for infant health decisions, creating a safety vulnerability through incorrect domain behavior rather than classic code execution.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The CLI claims to screen newborn jaundice while exposing a `--pet-type` parameter with `cat`, `dog`, and `other`, which directly contradicts the medical purpose and strongly suggests code reuse from an animal-analysis workflow. In a neonatal health tool, such domain confusion can misroute logic, apply the wrong model defaults, or generate unsafe false reassurance or alarm for caregivers.

Description-Behavior Mismatch

Medium
Confidence
74% confidence
Finding
The skill exposes report-history listing functionality that is not described in the manifest, increasing the accessible data surface beyond the advertised jaundice-risk analysis feature. In a medical context, report history may contain identifiers, health analysis outputs, or links to exported reports, so undocumented access paths can create privacy and authorization risks if upstream access control is weak or assumptions are wrong.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The implementation behavior does not match the declared neonatal jaundice screening purpose: it accepts generic video inputs and forwards them to a generic analysis backend. In a medical context, this mismatch is dangerous because users may trust the skill for health screening while the code appears capable of unrelated processing, expanding data collection beyond what was disclosed and undermining informed consent.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The hidden/open-id-driven history listing capability enables enumeration of prior analysis results that are unrelated to the stated purpose and may expose sensitive user medical or media-processing history. Because this is a neonatal-health skill, any unauthorized access to past analyses can reveal highly sensitive information about infants and caregivers, increasing privacy and compliance risk.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This file exposes a generic API wrapper with broad CRUD helpers and arbitrary HTTP methods that are not constrained to the neonatal jaundice screening purpose described in the skill manifest. In an agent/skill context, such reusable network primitives can be repurposed to access unrelated services or exfiltrate sensitive newborn images and metadata, expanding the attack surface beyond the declared medical function.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The http_post/http_put/http_get/http_delete methods accept arbitrary URLs and pass them directly to RequestUtil, giving the skill unrestricted outbound HTTP capability. In the context of a neonatal imaging skill handling potentially sensitive infant health data, this creates a serious risk of unauthorized data transmission, SSRF-style access to internal resources, or abuse of the skill as a general network client unrelated to its stated purpose.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file defines a reusable user persistence layer, including account identity fields, for a skill described as neonatal jaundice image analysis. This scope mismatch increases privacy and supply-chain risk because the skill can retain user/account data unrelated to its stated medical-screening function, making hidden data collection more plausible.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The User model stores token and open_token values in plaintext local SQLite storage, yet authentication-token handling is not justified by the skill's neonatal screening purpose. If the database is accessed by another local component or copied from the shared workspace data directory, those tokens could enable account takeover or unauthorized API access.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This utility creates, resolves, and persists user identities outside the declared neonatal jaundice screening purpose, including reading an internal identity from a local file and generating fallback user IDs. In a medical-image screening skill, hidden identity provisioning materially expands data handling scope and can silently link users to remote services without clear necessity or consent.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The HTTP helper triggers a remote phone-login/registration flow by sending openId/mobile/source values to an external health endpoint. That behavior is unrelated to simple local jaundice-risk inference and can register or associate a user account silently, creating privacy, compliance, and unauthorized account-linkage risks.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This shared request utility supports broad remote API access, token management, account-state handling, retries, and automatic enrichment of outgoing requests with user and tenant identifiers. For a skill described as neonatal jaundice image screening, such generalized remote-control capability exceeds the stated scope and increases the chance of undisclosed data transfer or abuse through other callers.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The default trigger activates on broadly described newborn face media needing analysis, which can cause unintended execution on sensitive infant images without sufficiently specific user intent. In a healthcare-adjacent skill, accidental activation increases the chance that sensitive images are processed or transmitted to a backend without clear consent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The history-query trigger phrases are broad enough to overlap with unrelated medical-report requests, which may cause the skill to fetch cloud-hosted report data unexpectedly. Because the records concern neonatal health and may be auto-associated with an internal identity, accidental retrieval could expose sensitive historical information.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill reads local files into memory and uploads them, or forwards remote URLs for analysis, without any visible user-consent, disclosure, or destination transparency in this code path. Because the content involves newborn facial imagery and medical-risk inference, silent transfer to an external analysis service materially raises privacy, compliance, and sensitive-data exposure concerns.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The CLI accepts a hidden API key parameter and passes remote-analysis parameters without clear user-facing disclosure, creating a risk that operators provide secrets or sensitive media under the false assumption of local-only processing. In a medical-imaging context, undisclosed remote transmission and secret handling can lead to credential leakage, accidental logging, and noncompliant transfer of protected data.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The debug log prints the full prompt content before sending it to the external agent path. If prompts contain sensitive medical data, patient identifiers, or other confidential inputs, enabling debug mode could leak that data into logs, consoles, or centralized log collectors.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code performs network requests containing usernames, open IDs, tokens, tenant codes, and platform metadata without any visible user-facing notice or confirmation in this path. In a healthcare-adjacent skill processing newborn imagery, undisclosed transmission of identifiers increases privacy and trust risks and may violate user expectations or policy requirements.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The function reads a credential-like file from the workspace data directory to obtain an internal identity value without any user disclosure in this code path. Even if local-only, silently consuming stored identity material broadens the data use beyond the skill's stated screening purpose and can enable unnoticed account association.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2