Parkinson's & Epileptic Behavior Recognition Skill | 帕金森癫痫行为识别技能

• Outcome: Review
• Latest audit: Oct 13, 2026 · 5:00 AM UTC
• Version: 1.0.16

Overview

The skill is a cloud medical-video analysis wrapper, but it silently creates or reuses persistent identities, stores tokens, and sends sensitive media and identity data to external services without clear user-facing consent or retention controls.

Review this skill before installing, especially if patient or bystander video may be processed. Treat uploads, report queries, account creation, identity linkage, token storage, and cloud retention as active data-sharing behavior; only use it where the external service, consent model, and deletion/reset process are acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (58)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, authentication handling, automatic retry, identity resolution, possible account creation/login, local filesystem operations, and user persistence, none of which are clearly declared in the purpose statement. In a medical-media workflow, those hidden capabilities can expose patients to unauthorized data transmission, silent identity correlation, and persistent storage of sensitive artifacts.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "parkinson-epilepsy-behavior-recognition-analysis"
description: "Identifies abnormal behaviors such as limb tremors, convulsions, stiffness, and gait abnormalities through video recognition, assisting in home risk monitoring for patients with chronic conditions. | 帕金森癫痫行为识别技能，通过视频识别肢体震颤、抽搐、僵硬、步态异常等异常行为，辅助慢性病患者居家风险监测"
version: "1.0.20"
license: "MIT-0"
---

# 🧠 Parkinson's & Epileptic Behavior Recognition Skill | 帕金森癫痫行为识别技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation contains a clearly unrelated surveillance/package-scanning description inside a medical behavior-recognition skill. This indicates copy-paste contamination or deceptive packaging, which undermines trust in the entire skill and raises the possibility of unrelated logic, endpoints, or data handling being embedded in a health-oriented workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill says uploaded media is automatically saved locally and that historical reports are fetched from a cloud API, but it does not present a clear privacy warning or retention/transfer disclosure. Because the content involves sensitive health-related video, undisclosed local persistence and cloud access materially increase privacy, compliance, and unauthorized-disclosure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file defines persistent user/account management for a skill advertised as video-based abnormal behavior recognition, which is a significant capability mismatch. Such hidden or unnecessary account handling expands the attack surface and raises the risk of covert data collection or unauthorized identity tracking unrelated to the stated medical-monitoring purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The model persists personal data and authentication-like material including username, realname, email, birthday, token, and open_token, none of which is justified by the skill's stated home video abnormal-behavior detection purpose. In a health-related context this is especially risky because it combines sensitive identity data with medical-adjacent monitoring, increasing privacy, breach, and misuse impact.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The utility code goes far beyond the manifest’s stated video behavior-recognition purpose by implementing workspace inspection, identity resolution, default user creation, token storage, remote login, and generic HTTP request capability. That mismatch materially increases the attack surface and enables stealthy account and network operations unrelated to the declared health-monitoring function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code silently performs remote phoneLogin/registration using a derived username/openId and may persist returned tokens locally. For a skill described as home video abnormal-behavior recognition, automatic creation/login of remote health-service accounts is unjustified and can expose users to account misuse, identity linkage, and undisclosed data flows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares no explicit tool/permission scope even though the documentation instructs use of shell execution, filesystem access, environment usage, and network/API communication. In an agent setting, missing scope boundaries increases the chance of over-privileged execution and makes it harder to review whether the skill is allowed to access local files, persist uploaded media, or contact remote services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default trigger activates broadly whenever a user provides monitoring video needing abnormal behavior recognition. Overly broad triggers can cause accidental invocation on sensitive media, increasing the chance of unintended upload, storage, or analysis of patient or bystander footage without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function exposes a listing capability keyed by open_id that is unrelated to the advertised purpose of video behavior recognition. Features that retrieve identity-scoped historical analysis data expand the attack surface and can enable unauthorized enumeration or disclosure of another user's records if identity handling elsewhere is weak or manipulated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The command-line description and help text are presented only in Chinese, and runtime status/error messages are likewise hardcoded in Chinese. This imposes a specific language/locale without offering a user-selectable alternative or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The CLI initializes and resolves an internal identity even before deciding whether identity is needed for the requested operation. Hidden identity binding in a media-analysis tool can cause requests and stored results to be associated with an internal account without clear user awareness, increasing the risk of privacy violations, cross-user data access, or misuse of backend identity-dependent functions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Hidden internal identity initialization without clear disclosure is a security-relevant transparency problem because users may unknowingly perform account-bound operations. In a health-monitoring context, silently attaching actions or results to an internal identity can expose sensitive behavioral or medical-adjacent data and undermine consent and auditability.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2