Security audit
Security checks for vulnerabilities and agentic risk
This health-video skill has a coherent cloud-analysis purpose, but it silently creates or reuses user identities and persists tokens/profile data while handling sensitive media and reports.
Review before installing. Use only where users consent to sending respiratory videos or URLs to the configured cloud service, querying historical reports, and creating/reusing a local or remote identity whose tokens may be stored in the workspace data directory. Avoid using it with sensitive health media unless the publisher, retention policy, and account model are acceptable.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
Authenticated external API calls, user identity creation/retrieval, local workspace reads/writes, and path-management utilities together indicate broad operational capabilities unrelated to the claimed computer-vision purpose. In a medical-data workflow, that hidden breadth makes unauthorized collection, retention, and transfer of sensitive information significantly more dangerous.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "respiratory_symptom_recognition_analysis"
description: "Based on computer vision, automatically detects coughing, phlegm, and wheezing frequency, counts the frequency of episodes, used for early health anomaly alerts, helping to detect respiratory diseases in a timely manner. | 呼吸道症状智能识别技能，基于计算机视觉自动检测咳嗽、咳痰、喘息频率，统计发作频次，用于健康异常早期提醒，帮助及时发现呼吸道疾病"
version: "1.0.19"
license: "MIT-0"
---
# 🫁 Respiratory Symptom Smart Recognition Tool | 呼吸道症状智能识别工具
> **智能分析中枢** · 图片/视频智�
The implementation is a generic video-analysis wrapper that accepts arbitrary local files or remote URLs and delegates them to a broad analysis backend, while the manifest claims a narrowly scoped respiratory-symptom recognition capability. This mismatch is dangerous because it can enable undeclared collection or analysis of unrelated visual content, undermining user consent, policy enforcement, and any trust boundary based on the declared medical-purpose scope.
This file implements a generic HTTP client wrapper with broad CRUD methods and arbitrary GET/POST/PUT/DELETE support, which is far wider than the declared respiratory-symptom recognition purpose. In a skill context, this expands the attack surface substantially: other components can reuse this helper to call unrelated internal or external endpoints, enabling unauthorized data access, modification, or exfiltration if inputs or URLs are influenced by untrusted sources.
This file provides a generic shared SQLite DAO plus user-management behavior that is not justified by the stated purpose of respiratory symptom recognition. Capability mismatch is dangerous because it expands the skill's data access surface to persistent cross-component storage and account-like records, increasing the chance of unnecessary collection, retention, or misuse of user data.
The User model and UserDao persist identity/profile fields including username, realname, email, birthday, age, and tokens, none of which are clearly necessary for respiratory symptom detection. In context, this unjustified identity persistence is more concerning because a health-related skill can combine medical-adjacent signals with personally identifiable information, creating privacy and compliance risk if accessed or leaked.
The code resolves or creates default open-id identities, including generating persistent local identities when none are provided. For a medical-analysis skill, silently creating or reusing user identities is unjustified and dangerous because it can enable unauthorized account creation, attribution confusion, and background linkage of user activity to persistent identifiers.
This utility module performs authenticated remote API access, token handling, local user lookup, and even account provisioning logic that is unrelated to a respiratory symptom recognition skill's stated purpose. In this context, hidden service access and identity bootstrapping materially expand the attack surface and create covert data-transfer and account-abuse risk.
The skill declares no explicit tool scope or permission boundaries while its documented behavior and referenced scripts imply access to shell execution, network requests, local file persistence, environment data, and filesystem reads/writes. In an agent ecosystem, missing least-privilege declarations makes it easier for a seemingly medical-analysis skill to perform broader actions than users or orchestrators expect.
The documentation broadens the skill from symptom recognition into cloud report querying and report-link retrieval, which expands both network exposure and access to potentially sensitive historical health data. Scope expansion without clear permissioning or disclosure is risky because users may not realize the skill can enumerate and surface prior reports.
The trigger conditions and operational instructions are primarily specified in Chinese, including the exact phrases that cause automatic activation. The file does not state that users may interact in other languages or provide an opt-in choice for language/locale behavior.
Overly broad trigger phrases for historical-report queries can cause the skill to activate in response to generic requests and retrieve cloud-based report data unintentionally. This raises the chance of accidental disclosure of sensitive historical health information in multi-skill or ambiguous conversations.
Automatically saving uploaded attachments locally without clear user warning creates undisclosed data retention of potentially sensitive medical media. Local persistence increases exposure to accidental leakage, unauthorized access, and retention beyond user expectations.
Mandating direct cloud API queries for historical reports without a clear user-facing warning obscures that sensitive report data is fetched from a remote service. Users may reasonably assume local-only processing for a health-monitoring skill, making the undisclosed cloud retrieval more dangerous.
Detected: suspicious.install_untrusted_source