Public Place Group Emotion Index (Exhibition / Mall) | 公共场所群体情绪指数（展览/商场）

• Outcome: Review
• Latest audit: Aug 26, 2026 · 8:17 PM UTC
• Version: 1.0.11

Overview

The skill matches its advertised cloud video-emotion analysis purpose, but it silently creates and reuses user identity data and stores tokens for a sensitive public-camera workflow.

Review this skill carefully before installing. It should only be used where public-camera emotion analysis is lawful, posted notice and consent requirements are handled, and you are comfortable with media or URLs going to the configured remote service. Treat the silent account creation, persistent local database, and token storage as the main risks; do not use it for anonymous-only workflows unless those behaviors are removed or explicitly governed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation directs execution of local Python scripts, local file saving, shell invocation, network access, and likely use of environment-backed identity/configuration, yet it declares no explicit permissions. This creates a capability/permission mismatch that can mislead operators and enforcement layers about what the skill is actually allowed to do, increasing the chance of overbroad access and unsafe execution.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill claims anonymous emotion analysis and prohibits identity handling, but later instructs the system to auto-create and reuse a default user identity for associating reports. Even if the identity is internal, this undermines the anonymity claim and enables persistence/linkage of analysis results across sessions, which raises privacy and compliance risk for sensitive public-camera analytics.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill is described as analyzing human group emotion in public places, but the implementation exposes a generic `pet_type` selector and mutates a shared default based on user input. This creates a semantic and policy mismatch: callers may trigger unintended model/backend behavior, weakening safety assurances, auditability, and correctness for a sensitive surveillance-related use case.

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: The CLI help says the public-place emotion analysis scenario only supports `other`, yet the parser accepts `cat` and `dog`. This inconsistency can mislead operators and allow unsupported execution paths, which is especially problematic in a human-emotion surveillance context where predictable, constrained behavior is important.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The code explicitly comments that open_id is required, then disables the check and proceeds with analysis requests anyway. If the downstream service relies on open_id for tenant binding, authorization, auditing, or per-user scoping, this omission can permit unauthenticated or misattributed analysis jobs and weaken accountability controls.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: Report listing proceeds even though the code indicates open_id should be required. In a multi-user or multi-tenant system, omitting requester identity for list operations is more dangerous than analysis submission because it can expose prior reports, metadata, and export links belonging to other users or organizations.

Context-Inappropriate Capability

Low

• Confidence: 71% confidence
• Finding: The history-listing capability exposes prior analysis records through `show_analyze_list(open_id=...)`, but the skill description does not justify a retrospective listing feature for this narrowly scoped public-place emotion-analysis tool. In a surveillance/emotion-analysis context, historical result access can expand privacy and data-governance risk, especially if identifiers or prior outputs are accessible without clear user expectation or least-privilege controls.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: This service exposes broad generic CRUD and arbitrary HTTP wrapper methods that are not clearly constrained to the stated purpose of anonymous group-emotion analytics. In a skill handling sensitive public-camera analytics, such unrestricted network and object-management primitives can enable unintended data access, backend action abuse, or expansion of the skill into unrelated capabilities if higher-level inputs are attacker-controlled.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file defines a reusable local user/account database layer, including username-based lookup and persistence, despite the skill being described as anonymous public-place group-emotion aggregation. That mismatch materially increases the chance of unnecessary identity collection, local profiling, and function creep beyond the declared purpose.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: The User schema stores personally identifiable and credential-like fields including real name, email, birthday, age, token, and open_token. For a skill claiming anonymized expression recognition in public places, retaining this data is unnecessary and dangerous because it enables identity linkage, account misuse, and sensitive data exposure if the local database is accessed or repurposed.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module documentation presents the code as a generic lightweight CRUD wrapper, but the implemented schema includes identity and token storage inconsistent with the skill's anonymized purpose. This kind of design/documentation mismatch is dangerous because it obscures real data handling and can bypass scrutiny, privacy review, and least-privilege expectations.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The utility layer performs automatic account lookup, registration/login, token acquisition, and persistence of authenticated user state that is unrelated to the stated purpose of anonymous group-emotion analytics. In this skill context, hidden identity provisioning materially increases privacy and supply-chain risk because using the skill can silently bind usage to persistent accounts and external services.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code resolves, reads, reuses, and creates persistent open-id style identifiers from local files and a database even though the skill description emphasizes anonymized recognition only. That mismatch is dangerous because operators may believe the system is anonymous while the implementation establishes durable identity state that can enable tracking, attribution, or undisclosed linkage across sessions.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The code comments claim safe handling of headers, but exception/debug branches still include header-related output paths and enable verbose HTTP debugging globally. In debug deployments this can expose authentication tokens, request metadata, or sensitive payloads into logs, which is especially concerning for a system processing camera-derived analytics and external API credentials.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default trigger is broad enough to auto-invoke this skill for general public-place video requests, which can cause unintended facial-expression analysis on uploaded footage without sufficiently explicit user intent. In a surveillance-adjacent context, accidental invocation increases privacy risk and the chance that sensitive media is sent to downstream scripts or cloud APIs unexpectedly.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill prominently advertises public-place facial-expression analysis and cloud-hosted report retrieval, but the user-facing summary does not prominently foreground privacy, data transmission, local file handling, and retention implications. Because the content involves camera footage of people in public spaces, weak upfront disclosure increases the risk of uninformed use and noncompliant handling of sensitive media.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI accepts a hidden `--api-key` parameter and supports network-backed analysis via URL/API parameters without visible disclosure to users about credential use or remote data transmission. In a skill processing public-place video, this is more sensitive because operators may unknowingly send surveillance footage or related metadata to external services, creating confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The helper automatically sends openId/mobile/source fields to a remote login/registration endpoint without any visible user-facing disclosure or opt-in. In a skill marketed around anonymous public-place analytics, silent transmission of identity-linked data undermines privacy expectations and can create compliance exposure.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 90% confidence
• Finding: requests.post(_url, json=

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-public-place-group-emotion-index-analysis"
description: "Using fixed cameras in malls, exhibition halls, scenic areas and other public places, the system analyzes facial expressions of multiple people in the scene in real time (with anonymized expression recognition only), aggregates the distribution of emotions (happy, calm, irritated, surprised, sad, fearful, etc.), and computes an overall group-emotion index (0-100; higher = more positive). | 通过商场、展览馆、景区等公共场所的固定摄像头，实时分析场景中多人的面部表情（使用匿名化表情识别），统计各类情绪（愉悦、平静、烦躁、惊讶、悲伤等）的分布比例，计算整体情绪指数（0-100，数值越高代表群体情绪越积极）。该技能可帮助运营方了解顾客满意度、优化服务布局，或用于公共安全预警（如烦躁情绪比例过高可能预示冲突风险）。"
version: "1.0.11"
license: "MIT-0"
---

• Confidence: 78% confidence
• Finding: description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2