Security audit

Rehab Patient Frustration / Giving-up Tendency Motivation | 康复患者沮丧/放弃倾向激励

Security checks across malware telemetry and agentic risk

Overview

This skill handles sensitive rehab videos and cloud reports, but it silently manages identity, tokens, history access, and notifications in ways users should review carefully before installing.

Install only in a governed rehab setting where patients have explicitly consented to video/audio analysis, biometric identification, cloud upload, retained history, and therapist/family notifications. Verify the API endpoints and disable any dev/private-network configuration before use, and ensure token storage and report access are acceptable for your privacy requirements.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)
Confidence: 76% confidence
Finding: This query builder accepts filter keys dynamically and resolves them via getattr(self.__model__, key). While SQLAlchemy prevents classic SQL injection here, untrusted callers can still select arbitrary model columns for filtering, which can enable unauthorized querying over sensitive fields and weaken intended access controls if this generic DAO is exposed to higher layers.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) return query.scalar() finally:
Confidence: 74% confidence
Finding: The count() method repeats the same dynamic filter pattern, allowing callers to probe arbitrary columns when filters originate from user input. In a skill handling sensitive patient-adjacent data, even metadata leakage through counts can aid enumeration or inference about stored records.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill document instructs use of local scripts, local file handling, cloud/API access, and shell execution, yet it declares no explicit permissions or capability boundaries. This creates a transparency and governance gap: a user or host agent may believe the skill is passive video analysis while it can read/write files, invoke commands, and send sensitive rehabilitation data over the network.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest frames the skill as analysis/detection, but the body adds active intervention such as personalized audio playback, screen output, therapist app alerts, and family notifications. This mismatch is dangerous because downstream systems may approve or invoke the skill under a lower-risk classification than its actual behavior warrants.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Face recognition bound to patient IDs is a highly sensitive biometric processing capability that is not necessary to detect frustration behaviors from a rehab session. In this medical-like context, unnecessary identity binding increases privacy, surveillance, and re-identification risk, especially when paired with historical trend tracking and cloud reporting.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Urgent pushes to family members extend the skill from monitoring into third-party disclosure of sensitive patient status. That is dangerous because it can leak health-related inferences and patient behavior data beyond the immediate care team without clear necessity, consent, or access-control justification.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatically creating and reusing a default local user identity introduces hidden identity persistence and risks cross-user data mixing. In a rehabilitation setting, this can cause one patient's videos, reports, or history queries to be associated with another profile, leading to privacy breaches and incorrect interventions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill accepts arbitrary HTTP/HTTPS video URLs even though the manifest describes analysis of fixed-camera rehab footage, expanding the input surface beyond the stated capability. This can enable server-side fetching of attacker-controlled resources, creating privacy, compliance, and potential SSRF-style risks depending on how downstream analysis services retrieve the URL.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The skill exposes report-listing and export-link generation functionality that is not described in the manifest, increasing the effective privilege and data exposure of the skill. In a rehab/health context, report metadata and export URLs may reveal sensitive patient analysis results or enable unauthorized enumeration if access control is weak elsewhere.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script explicitly accepts arbitrary remote URLs via the --url argument even though the skill description frames the capability as analysis of fixed rehabilitation-camera footage. Allowing unrestricted external URLs expands the data source beyond the declared scope and can enable unexpected ingestion of third-party content or internal network-reachable resources through the backend that processes the URL.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The --list functionality exposes historical analysis retrieval that is not described in the stated skill purpose. Hidden or undocumented access to prior analysis records increases the chance of privacy violations, especially in a rehabilitation context where outputs may contain sensitive behavioral or health-related inferences.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The code resolves a current open_id and uses it to access history, but the manifest only describes video analysis, not identity-linked retrieval of prior records. Tying sensitive rehabilitation analysis to a user identifier without clear justification or visible access-control logic raises risk of cross-user data exposure and privacy misuse.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: This file exposes broad generic network primitives and CRUD wrappers (`http_get`, `http_post`, `http_put`, `http_delete`, `add`, `edit`, `delete`, `page`, `list`) that are not constrained to the rehabilitation-video analysis purpose described for the skill. In an agent skill context, this unnecessarily expands capability scope and can be abused by other skill logic to call arbitrary internal or external endpoints, increasing the risk of data exfiltration, unauthorized actions, or SSRF-like misuse if attacker-controlled URLs or parameters can reach these methods.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill is described as rehab-motivation video analysis, but this shared DAO persists user account/profile records including identifiers and other personal data unrelated to that narrow purpose. That creates unnecessary collection and retention of personal information, increasing privacy and compliance risk, especially in a rehabilitation context that likely involves sensitive health-related environments.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The model stores authentication tokens, open tokens, email, birthday, age, and real names without clear necessity for the stated rehab analysis function. Retaining such sensitive profile and credential material in a local SQLite database broadens the blast radius of compromise and is especially risky given the likely presence of patient or healthcare-adjacent data.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This utility code provisions identities, performs login/registration against an external health service, and stores tokens locally, even though the declared skill purpose is rehab-video frustration analysis. That creates hidden account creation, credential handling, and outbound data flows unrelated to the stated function, which is especially sensitive in a healthcare context.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code inspects workspace paths, environment variables, and later supports reading identity material from local workspace data. For a skill framed as camera-based rehab behavior analysis, this is unrelated capability that broadens access to local execution context and can facilitate collection of sensitive operational metadata.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The default trigger activates on broadly described rehab video or URL analysis requests, which can cause the skill to run in situations where the user did not intend sensitive frustration monitoring or cloud processing. Because the content involves health-adjacent surveillance data, overly broad invocation increases the chance of accidental analysis and unauthorized processing.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The history-report auto-trigger uses broad report-browsing phrases that may match ordinary requests and automatically query cloud-stored patient records. This is dangerous because it can expose sensitive historical rehabilitation data without sufficiently clear scope, identity verification, or user confirmation.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill handles highly sensitive continuous video/audio monitoring and cloud transmission of patient rehabilitation data, yet the user-facing description does not clearly warn about those privacy and security implications. In this context, missing disclosure undermines informed consent and can lead to covert collection or transmission of biometric, behavioral, and health-related information.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This API document describes surveillance-based analysis of highly sensitive health, behavioral, video, audio, and identity-linked patient data, but it does not present a prominent upfront warning section summarizing privacy risks, consent requirements, monitoring scope, data retention, and escalation effects before the operational details. In this rehab context, the system can trigger interventions toward vulnerable patients, so missing clear warnings increases the risk of unsafe deployment, uninformed use, and privacy-invasive processing beyond what users or operators fully understand.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code reads the entire local video file and transmits it to an external analysis service without any visible user-facing notice, consent flow, or minimization in this file. Because the skill processes rehabilitation videos, the content is likely highly sensitive health data, making silent upload particularly risky for privacy, compliance, and user trust.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The tool sends a local file path or remote URL to a backend analysis function and only prints a generic 'analyzing' message, without making network transmission of potentially sensitive rehabilitation footage explicit. In this context, the data likely contains health-related video and behavioral inferences, so silent transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Enabling HTTPConnection and urllib3 debug logging can expose request URLs, bodies, and authentication material in logs. In a healthcare-adjacent skill, those logs may contain patient-related or account-related data, increasing confidentiality risk if debug mode is enabled in production-like environments.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function reads an internal identity value from a local data file without any user-facing notice or clear necessity for the advertised rehab-analysis purpose. Accessing credential-like material from workspace storage creates a risk of covert identity reuse and unintended account association.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2