Respiratory Symptom Smart Recognition Tool | 呼吸道症状智能识别工具

• Outcome: Review
• Latest audit: Aug 26, 2026 · 2:19 PM UTC
• Version: 1.0.15

Overview

This health-video analysis skill appears purpose-related, but it sends sensitive media to remote services and silently creates or reuses persistent identity records for report history.

Review before installing. Use only if you are comfortable sending respiratory health videos or URLs to the configured SMYX/Life Emergence service and allowing the skill to create or reuse local identity records and tokens for report history. Avoid patient or regulated health data unless you have explicit consent and appropriate privacy controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises only symptom-recognition functionality, but its documented behavior and referenced scripts imply filesystem, shell, network, and environment access without any declared permission model or user-visible scoping. In a medical context, these undeclared capabilities increase the risk of unexpected data exfiltration, local persistence, or command execution beyond what a user would reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill extends beyond real-time respiratory symptom recognition into automatic cloud-based historical report retrieval, which is a separate data-access capability involving potentially sensitive medical history. That broadened scope increases privacy and authorization risk, especially because the trigger phrases are automatic and the cloud lookup is mandatory rather than clearly user-consented at query time.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the system to silently reuse or create a local default user identity and associate reports automatically, which is an identity-management function unrelated to basic symptom analysis. This can cause cross-user data leakage, incorrect report attribution, and unauthorized access to prior medical reports if identity is inferred or reused without explicit verification.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill states that uploaded attachments and media files are automatically saved locally, even though the manifest primarily presents an analysis tool. Automatic local storage of sensitive medical media expands retention and breach risk, especially if users are not clearly informed about where files are stored, for how long, and who can access them.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The CLI performs hidden identity resolution via OpenIdUtil.resolve_current_open_id and exposes a --list mode that retrieves prior analysis history, which goes beyond the declared purpose of analyzing a respiratory video. In a health-related skill, undeclared access to user identity context and historical records can expose sensitive medical metadata and create privacy and authorization risks if invoked without clear consent and access controls.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The function accepts arbitrary URLs and forwards them for analysis without visible allowlisting or scheme/host restrictions. This broadens the skill from local video analysis to remote resource fetching, which can enable server-side request forgery, unintended access to internal resources, or processing of untrusted remote content depending on how downstream code handles the URL.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill accepts either arbitrary local file paths or arbitrary external URLs and forwards the referenced video content to a remote analysis backend with no visible restriction tying inputs to the stated respiratory-symptom use case. In a health-analysis skill, this broad data-ingestion behavior increases the chance of unintended data exfiltration, misuse on unrelated content, and scope creep beyond what users would reasonably expect from the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code constructs and returns report export links and also supports listing prior analysis reports, which expands the skill from single-purpose symptom detection into report retrieval and enumeration. If access control is weak elsewhere, this capability could expose prior analysis artifacts or metadata not necessary for the core function, increasing privacy and data-leakage risk in a medical context.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The file exposes a historical analysis listing function via `skill.get_output_analysis_list(open_id=open_id)` that is not necessary for the stated single-purpose respiratory symptom recognition workflow. In a health-related context, access to historical analysis results can expose sensitive medical or behavioral data, especially if `open_id` resolution or backend authorization is weak.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This file implements a generic network-capable API wrapper with broad CRUD methods and arbitrary HTTP GET/POST/PUT/DELETE forwarding that are not constrained to the stated respiratory symptom recognition purpose. In an agent skill context, such unrestricted network primitives materially expand the attack surface by enabling unexpected outbound requests, proxying, data exfiltration, or interaction with unrelated backend services if other parts of the skill can influence URLs or payloads.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The presence of get_user_by_username introduces user-account lookup capability unrelated to computer-vision respiratory symptom detection, indicating scope creep into identity or directory functions. In a health-related skill, this increases sensitivity because it may enable user enumeration, correlation of health data with identities, or unauthorized access paths to personal account information.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file defines persistent user/account storage for usernames, real names, email, birthday, tokens, and related identity fields, which is materially outside the declared purpose of a respiratory symptom recognition skill. In a least-privilege review, that scope mismatch is dangerous because it enables collection and retention of sensitive user data unrelated to the advertised function, increasing privacy, misuse, and unauthorized access risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The model stores authentication/profile-related data including token and open_token alongside personal identifiers. For a respiratory-analysis skill, this is unusually sensitive and unnecessary on its face, making the code more dangerous because it can accumulate credentials and PII that would be highly valuable if exposed or abused.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The DAO provides broad generic CRUD capabilities and automatic database creation for arbitrary models, which exceeds the narrow analytic function described for the skill. In context, that expanded persistence surface increases the chance of undisclosed data collection, unauthorized state management, and future abuse through code reuse beyond the stated medical-monitoring purpose.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file for a respiratory symptom recognition skill exposes a generic `ai_chat` capability that is unrelated to the stated medical/computer-vision purpose. Hidden or unnecessary agent-execution surfaces increase attack surface, enable unintended outbound AI/tool use, and make it easier for downstream code to repurpose the skill beyond its declared scope.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This shared utility performs remote account provisioning, token acquisition, token persistence, and authenticated API calls that are unrelated to the declared respiratory-symptom recognition purpose. In a vision-based health skill, hidden identity bootstrap and outbound tokenized communications expand the trust boundary and can enable covert data exfiltration or unauthorized use of external services.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads a workspace identity file, queries a local database for user records, and creates a persistent default open-id when none exists. For a respiratory recognition skill, silently establishing durable identity state is unnecessary and dangerous because it can track users across runs and couple a health-related tool to broader account infrastructure without clear disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The workspace and agent-environment discovery code enumerates execution context, derives workspace roots, and creates agent-specific data/skills directories. That capability is broader than needed for symptom detection and increases the blast radius by enabling the skill to locate and interact with files across the agent workspace structure.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The history-report trigger phrases are broad enough that ordinary conversational requests could unintentionally invoke cloud retrieval of sensitive health data. In a medical setting, accidental triggering materially raises privacy and consent risks because report lookup may occur without a clear, deliberate user action.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill handles medical-related videos, uploaded files, and cloud-based report queries, yet it does not clearly warn users that sensitive health media and metadata may be transmitted to external APIs. Lack of transparent privacy disclosure undermines informed consent and can expose users to serious confidentiality risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document says respiratory symptom videos are uploaded to a cloud vision AI service for health analysis, but it does not warn users about transmission, storage, or privacy risks for sensitive health and biometric data. In a medical-monitoring context, this omission can cause users or integrators to expose highly sensitive patient footage without informed consent, proper safeguards, or compliance review.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill reads local video files into memory or accepts remote video URLs and submits them for analysis without any visible user-facing warning, consent prompt, or disclosure in this code path. Because the data may contain sensitive medical or biometric information, silent transmission to a remote service creates a meaningful privacy risk even if the backend is legitimate.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The hidden `--api-key` argument enables credential-bearing operation without user-facing disclosure in help text, which reduces transparency and can mask sensitive network behavior. In combination with the generic remote-analysis flow, this can facilitate silent use of privileged backend access or cause operators to pass secrets on the command line, where they may be exposed through shell history or process listings.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When debug mode is enabled, the code turns on low-level HTTP connection debugging and urllib3 debug logging, which can expose request URLs, headers, payloads, and responses. Because this utility also handles tokens and user identifiers later in the file, the logging behavior can leak sensitive authentication or health-related data into logs without explicit user warning.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code reads an internal identity value from a local workspace file (data/smyx-api-key.txt) without any visible user disclosure or purpose limitation in this skill. While local file reads are common, silently consuming credential-like identity material is risky in a health-related skill because it broadens data access beyond the stated function.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2