Parkinson's & Epileptic Behavior Recognition Skill | 帕金森癫痫行为识别技能

• Outcome: Review
• Latest audit: Aug 25, 2026 · 10:44 AM UTC
• Version: 1.0.12

Overview

This skill has a coherent video-analysis purpose, but it under-discloses sensitive cloud upload, silent account setup, token persistence, and development/private endpoint behavior.

Review before installing. This skill may upload sensitive medical or household video to a remote service, silently create or bind an account-like identity, store tokens in a workspace database, and query cloud report history. Install only if the publisher documents the service endpoints, consent flow, retention/deletion policy, and why dev/private HTTP configuration is included.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 82% confidence
• Finding: This method builds query predicates from caller-supplied filter keys using getattr(self.__model__, key) without validating that the key is an allowed column. While SQLAlchemy prevents classic SQL injection here, untrusted callers can still trigger access to unintended model attributes, cause exceptions for invalid keys, and potentially bypass intended query restrictions if this generic DAO is exposed through higher-level interfaces.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 81% confidence
• Finding: The count() method repeats the same pattern of resolving model attributes from unvalidated filter keys. If higher-level code passes attacker-controlled filters, this can lead to unexpected attribute access, denial-of-service via runtime errors, or querying on fields that should not be user-selectable.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and instructs use of shell execution, network access, local file handling, and implicit environment/identity handling, but does not declare any permissions or clearly bound those capabilities. In a medical-video context, this creates an opaque trust boundary where sensitive files and report data may be read, written, and transmitted without explicit consent or sandbox expectations.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The English overview describes a different surveillance use case—express-package monitoring in community and office areas—while the rest of the skill claims medical behavior recognition. This mismatch can mislead operators about what data is being processed, where it is deployed, and whether the skill is intended for patient monitoring versus broader surveillance, increasing the risk of improper activation and privacy misuse.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file exposes a broad, generic API wrapper for arbitrary POST/PUT/GET/DELETE operations plus generic CRUD helpers, which substantially exceeds the stated purpose of a video-based medical behavior recognition skill. In a healthcare-adjacent context, this kind of undeclared general network capability increases the risk of hidden data exfiltration, unauthorized backend manipulation, or reuse of the skill as a proxy to unrelated services.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The get_user_by_username helper introduces user-account lookup functionality that is not justified by the declared medical video-analysis purpose. Such a capability can enable user enumeration, linkage of medical activity to identities, or access to unrelated account metadata if exposed through the skill flow.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: This file defines persistent user-account storage and lookup behavior that does not align with the advertised purpose of video-based abnormal behavior recognition. Capability mismatch increases risk because it introduces hidden data-handling functionality—especially identity records and account reuse logic—that users may not expect or consent to in this skill context.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The User model stores identity and authentication-related fields including username, realname, email, token, and open_token, which are not justified by the stated medical behavior-recognition use case. In a health-related context, collecting extra identifiers and tokens materially increases privacy and account-compromise risk if the local database is accessed or reused by unrelated components.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file exposes a generic `ai_chat(prompt, session_id, timeout)` capability that is not constrained to the manifest’s stated purpose of video-based abnormal behavior recognition. In an agent-skill ecosystem, this kind of scope expansion can enable unintended prompt handling, data exfiltration, or policy bypass through a shared helper API that callers may reuse for arbitrary LLM interactions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility layer performs identity resolution, token handling, backend API access, local account persistence, and retry/auth flows that are far beyond the declared purpose of a video-based behavior recognition skill. That mismatch is dangerous because it silently expands the skill's trust boundary and enables collection, persistence, and transmission of user/account data to external services without clear necessity for the stated function.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code automatically calls an external health-service login/registration endpoint with generated or recovered identifiers, including openId and mobile fields, without any visible user approval flow. In the context of a home medical monitoring skill, this is especially sensitive because it can create or bind accounts behind the scenes and transmit identity-related data unrelated to local video recognition.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Embedding recharge and billing instructions inside a clinical behavior-recognition utility indicates hidden commercial workflow coupling that is unrelated to the manifest. While not a direct exploit primitive, it increases the chance of deceptive behavior, undisclosed monetization, and unexpected user redirection during sensitive health-related operation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code reads workspace identity from a file, falls back to local database records, and creates persistent default identifiers when none exist. For a skill advertised as video behavior recognition, this persistence of identity state is unjustified and dangerous because it silently tracks users across sessions and can later be used for backend account binding and data transmission.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The default trigger says the skill should automatically activate whenever a user provides monitoring video needing abnormal-behavior recognition, which is broad enough to capture ambiguous or unintended requests. In a sensitive medical and surveillance setting, over-triggering can cause unnecessary cloud uploads, analysis of unrelated footage, and accidental handling of regulated health data.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill processes highly sensitive medical video and supports cloud history/report retrieval, yet it does not prominently warn that images, videos, and derived reports may be transmitted to and stored by a remote service. Users may unknowingly expose protected health information and household surveillance footage without informed consent, which is especially dangerous in a healthcare-adjacent context.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API documentation explicitly states support for file uploads and full report export in a medical behavior-recognition context, but it provides no guidance on handling sensitive health data, privacy constraints, retention, access control, or export safeguards. Because this skill processes videos and generates reports about Parkinson’s and epilepsy-related behaviors, the omitted privacy/security requirements materially increase the risk of exposing protected personal and medical information through uploads, stored analysis results, or exported reports.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill transmits either a local video file's raw contents or a remote video URL to an analysis service, but this file contains no user-facing notice, consent gate, or privacy warning before doing so. Because the skill processes health-related behavioral videos, the data is highly sensitive; silent transmission can expose medical, biometric, and household information to external systems without adequate user awareness.

Missing User Warnings

Medium

• Confidence: 75% confidence
• Finding: The code automatically alters the existing sys_user schema at startup, adding identity-related columns without any explicit migration workflow or user disclosure. In this skill context, silent schema mutation is risky because it expands stored personal-data fields and changes local persistence behavior in a way users and operators may not expect.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When debug mode is enabled, HTTPConnection and urllib3 debug logging can emit request and response metadata that may include sensitive tokens, identifiers, or medical-service responses. In a health-monitoring context, even debug-only leakage is significant because logs may persist locally or be collected by surrounding systems without the user's awareness.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The utility reads an identity value from a workspace file without any visible notice, consent, or validation. While local file reads are common, in this skill context the value is later used for account identity resolution, making the undisclosed read part of a broader hidden identity-tracking flow.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code performs automatic network login/registration to an external service without a user-facing disclosure or explicit action. In a medical-adjacent skill, undisclosed outbound identity operations are particularly risky because users may reasonably expect local analysis rather than silent account creation and backend interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: This line transmits identity-bearing data to an external endpoint using requests.post as part of a silent registration/login flow. External transmission is expected only when necessary and disclosed; here, the transmission is mismatched with the stated video-recognition purpose and contributes to covert account provisioning behavior.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：jpg/jpeg/png/mp4/avi/mov，最大 10MB |
| 🧑‍⚖️ 结果性质 | **⚠️ 重要声明**：本识别结果仅供辅助监测参考，**不替代专业医疗诊断和医生判断**，发现频繁异常发作请及时就医调整治疗方案 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 81% confidence
• Finding: A hidden/unusual character indicator in operational instructions is suspicious because such content can be used to conceal prompt directives, alter rendering, or evade review and policy checks. In a skill that already contains strong operational instructions around data sourcing and report generation, hidden text increases the risk of covert behavior that an operator cannot easily audit.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "parkinson-epilepsy-behavior-recognition-analysis"
description: "Identifies abnormal behaviors such as limb tremors, convulsions, stiffness, and gait abnormalities through video recognition, assisting in home risk monitoring for patients with chronic conditions. | 帕金森癫痫行为识别技能，通过视频识别肢体震颤、抽搐、僵硬、步态异常等异常行为，辅助慢性病患者居家风险监测"
version: "1.0.15"
license: "MIT-0"
---

• Confidence: 78% confidence
• Finding: The metadata poisoning indicator, combined with the hidden-character finding, suggests the manifest may contain crafted content intended to influence tool selection, parsing, or downstream agent behavior in ways not obvious to human reviewers. Because the skill handles shell commands, network calls, and sensitive medical data, poisoned metadata can become a high-risk control-plane issue rather than a harmless formatting defect.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2