Stroke Risk Screening Analysis Skill | 脑卒中风险筛查分析技能

• Outcome: Review
• Latest audit: Aug 30, 2026 · 2:57 PM UTC
• Version: 1.0.12

Overview

This stroke-screening skill performs the advertised cloud analysis, but it also silently creates/reuses identities, stores tokens locally, and handles sensitive health media without clear user consent boundaries.

Review before installing. Use this only if you are comfortable sending facial images/videos, optional physiological values, and an internally resolved user identity to the configured backend service, and if you accept local token/profile persistence in the workspace data directory. The publisher should add an explicit privacy and consent step, fix the pet-health documentation mismatch, remove dev/private endpoint defaults, and provide clear controls for account linkage and stored-token deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 81% confidence
• Finding: Here, getattr(self.__model__, key) uses keys from the caller-supplied filters dictionary to resolve model attributes dynamically. If untrusted input reaches this method, an attacker can probe or access unexpected ORM attributes, trigger errors, or bypass intended field restrictions because there is no allowlist validation of filterable columns.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 81% confidence
• Finding: This repeats the same unsafe pattern in the count() method: caller-controlled filter keys are turned into model attribute lookups without validation. In applications exposing this DAO to higher-level user input, this can enable unauthorized querying on unintended fields and create a broader attack surface for data discovery or logic abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and operationalizes shell execution, file handling, environment use, and network access without any declared permission model or user-facing guardrails. In this context, those capabilities are used to process local files and call cloud APIs, so an agent could access sensitive media or transmit data off-device without explicit authorization boundaries.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The API documentation describes pet health analysis endpoints and scenario codes inside a skill advertised for stroke-risk screening. This kind of domain mismatch is dangerous because it can cause the agent to call the wrong backend, mix medical contexts, or expose/report unrelated health data, creating both safety and privacy risks in a medical-adjacent workflow.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The CLI includes a hidden identity/listing workflow via --open-id and --list that is not part of the advertised stroke-screening function. Because it resolves an internal user identity and can enumerate analysis history, it expands the skill into account-scoped data access without clear authorization or user disclosure, creating a privacy and data-exposure risk.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This module exposes generic HTTP and CRUD wrapper methods that are not constrained to stroke-risk screening functions, enabling arbitrary backend interactions if other parts of the skill can influence the URL or payload. In a medical skill context, this over-broad capability increases the attack surface and can enable unauthorized data access, modification, or unexpected service invocation beyond the declared purpose.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The user lookup helper introduces identity-related access that is not clearly needed for stroke screening and may expose account enumeration or retrieval of user information if invoked improperly. In a healthcare-related skill, even limited user-identification functionality is more sensitive because it can facilitate access to personal or medical context.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The model stores identity fields and authentication-like tokens (token, open_token, email, realname) in a local SQLite database without any visible encryption, minimization, retention control, or justification tied to stroke-risk screening. In a medical-context skill, collecting and persisting extra identifiers and tokens increases privacy and account-compromise risk if the local database is accessed by other skills, users, or malware.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This utility silently creates or reuses user identities, performs phone-login style registration, and persists tokens locally as part of ordinary request handling. For a stroke-risk screening skill, hidden account provisioning and credential persistence are out of scope and create unauthorized identity creation, token handling, and backend access risks without informed user consent.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code inspects OPENCLAW_WORKSPACE, parses __file__ paths, detects agent/workspace layout, and creates data/skills directories. In a medical screening skill this capability is unrelated to the stated purpose and expands filesystem awareness and write scope, increasing the chance of workspace reconnaissance or unintended modification of agent state.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The OpenId utility reads identity values from local files, searches local database state for reusable usernames, generates fallback identities, and persists them for future use. This hidden identity lifecycle management is not justified by stroke-risk screening and can cause silent account linkage, impersonation-by-default behavior, and local privacy leakage.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The auto-trigger phrases for history-report retrieval are broad enough to match ordinary user requests, which can cause unintended execution of cloud queries and disclosure of prior medical report metadata. Because this skill handles sensitive health information, accidental invocation materially increases privacy risk.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill encourages upload of facial images/videos and physiological indicators to a cloud-backed API but does not clearly warn users that sensitive biometric and health data may leave the local environment. Given the data type involved, omission of a prominent privacy notice can lead to uninformed consent and significant confidentiality harm.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill collects and transmits highly sensitive health information, including blood pressure, blood sugar, blood lipid values, and likely facial media, to an external analysis service without any explicit privacy notice, consent step, or disclosure of where the data is sent. In a medical-screening context, silent transmission materially increases confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code resolves and uses an internal user identity behind the scenes without clearly informing the user. Hidden identity binding is especially risky in a health-related skill because it can link sensitive screening activity to a specific individual and enable retrieval of that person’s prior records.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code reads a local file or accepts a remote URL and submits it to a remote analysis API without any disclosure, consent prompt, or in-band warning to the user. In a health-related skill handling potentially sensitive biometric or medical media, silent transfer to a backend creates meaningful privacy and compliance risk, especially if users may not realize their data leaves the local environment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script accepts a local file path or remote URL and submits it for analysis via external service logic without any explicit privacy notice, consent gate, or destination transparency at the point of use. In the context of a purported medical screening skill, the uploaded video may contain highly sensitive health or biometric information, increasing the risk of unintended disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When debug mode is enabled, the code turns on low-level HTTP tracing and verbose urllib3 logging, which can expose request metadata and potentially sensitive payloads or auth tokens in logs. Given the likely presence of medical and identity data, this creates a meaningful confidentiality risk even if intended for troubleshooting.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: These helpers create agent-local data and skills directories automatically, which means the skill can modify workspace state without explicit user notice. While not severe by itself, it contributes to unnecessary persistence and installation-related side effects that are out of scope for a stroke-screening skill.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The request utility automatically attaches identity fields, API keys, access tokens, and authorization tokens to outbound requests and can also trigger account creation logic. In a health-related skill, silent network transmission of identifiers and credentials without explicit notice or consent is especially dangerous because it may expose both authentication material and sensitive user context to remote services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Open-ID resolution reads identity data from local files and current process state, then persists or reuses that identity transparently. This is a privacy and consent problem because a medical screening skill should not silently infer, store, or continue using a user identity behind the scenes.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: This code performs an external POST to a health backend to silently log in or register a user using an openId/mobile-derived payload. Because it occurs in a generic utility path and supports hidden account creation, it represents unauthorized external transmission and backend interaction beyond the expected scope of a stroke-risk screening skill.

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：视频支持 mp4/avi/mov 格式，图片支持 jpg/png/jpeg 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 本技能仅作健康风险筛查提示，不能替代专业医学检查和医生诊断，发现高危请及时就医 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📁 格式支持 | 当显示历史筛查报告清单的时候，从数据 json 中提取字段  作为超链接地址，使用 Markdown 表格格式输出，包含" |

• Confidence: 88% confidence
• Finding: The malformed/hidden instruction content around report-output formatting suggests obfuscated or corrupted guidance embedded in the skill. Hidden or non-obvious instructions are dangerous in agent settings because they can alter execution or output behavior in ways reviewers and users cannot easily inspect, including shaping links or data disclosure.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "stroke-risk-screening-analysis"
description: "Combines TCM facial feature recognition with physiological indicator information to provide early warnings of high-risk stroke conditions such as cerebral infarction and cerebral hemorrhage, and provides lifestyle intervention suggestions and medical guidance. | 脑卒中风险筛查技能，结合中医面部特征辨识结合生理指标信息，提前预警脑梗塞、脑出血等脑卒中高危状态，给出生活干预建议和就医指引"
version: "1.0.14"
license: "MIT-0"
---

• Confidence: 74% confidence
• Finding: The metadata triggered a tool/manifest poisoning heuristic, and the file also contains other suspicious formatting issues, which raises concern that the manifest may be crafted to influence agent behavior outside normal review expectations. Although not overtly malicious on its face, poisoning indicators in agent-readable metadata are risky because agents may privilege manifest text when deciding what tools to run and what data to expose.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2