Trauma Stress Behavior Detection (Emergency Scene) | 受灾人群心理创伤行为识别（应急场景）

• Outcome: Review
• Latest audit: Oct 2, 2026 · 9:01 AM UTC
• Version: 1.0.13

Overview

The skill is not clearly malicious, but it analyzes sensitive shelter camera footage through a cloud service while silently managing identities and storing tokens, so it needs careful review before installation.

Install only in an authorized emergency-response setting with clear approval for camera surveillance, cloud processing, report retention, and operator access. Confirm who controls the lifeemergence.com service, how long footage and reports are retained, whether tokens are protected, and whether a real service identity is supplied instead of the auto-created default user.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (55)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform external API communication, account/login handling, token or credential management, filesystem access, and local database interaction, none of which are clearly disclosed by the top-level purpose statement. In a surveillance-and-mental-health context, these hidden capabilities materially increase the risk of unauthorized access, data exfiltration, and secondary use of sensitive footage and reports.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-trauma-stress-behavior-detection-analysis"
description: "Using fixed cameras in emergency shelters, the system analyzes video of disaster-affected crowds to detect typical acute stress reactions: stupor (prolonged motionless state with no response to external stimulation), tremor (involuntary shaking of body or limbs), unresponsiveness (no orientation or avoidance reaction to calls or sounds), and hypervigilance (frequent scanning of surroundings, startle reactions). | 通过应急避难所内的固定摄像头，分析受灾人群的行为视频，检测急性应激反应下的典型行为：木僵（长时间静止不动，对外界�

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill describes continuous monitoring of disaster-affected people for psychological distress and cloud report handling, but does not foreground a clear privacy and data-collection warning in the primary description. Because this involves vulnerable populations, inferred mental states, and potentially continuous camera surveillance, insufficient upfront disclosure is especially dangerous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The User model stores sensitive identity and authentication-related fields including real names, email, token, and open_token, none of which are necessary for the stated function of detecting acute stress behaviors from shelter camera feeds. In this context, unnecessary identity/token storage is particularly dangerous because disaster victims are a vulnerable population and compromise of these fields could enable tracking, impersonation, or cross-system account abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The utility implements broad outbound HTTP functionality, automatic auth/token handling, retry logic, remote login/account bootstrap, and payment-related response handling. For a skill advertised as fixed-camera behavioral analysis in emergency shelters, this is excessive and materially expands the attack surface for covert data transmission, dependency on external services, and unauthorized platform interactions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code provisions accounts against a remote service, retrieves tokens, and persists identity/token material locally in a user database. That capability is unrelated to the stated shelter video stress-detection purpose and creates unnecessary credential handling, account creation, and user-tracking behavior that could expose operators or affected individuals to unauthorized external linkage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell scripts, reads/writes local files, uses network access, and appears to touch environment/config state, yet declares no explicit tool/permission scope. That creates an over-privileged and ambiguous execution surface, making it easier for a host agent to grant broader capabilities than the stated task requires.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill expands from live behavior detection into cloud-backed historical report retrieval and report-link output, which broadens the data lifecycle and sensitivity far beyond immediate analysis. In a crisis-surveillance setting, this creates additional exposure for sensitive behavioral and psychological alert records.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that if no upstream identity is provided, it will automatically reuse or create a local default user. Silent identity creation/reuse is dangerous because it can bind sensitive trauma-analysis uploads and history queries to an unintended account, undermining auditability, consent, and access control.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill mandates use with China-specific authorities, laws, credentialing bodies, and hotline numbers, but the document does not clearly state that the skill is restricted to a China-specific deployment context. Under the policy, hard-coded locale-specific requirements should either be optional/opt-in or clearly documented as region-specific and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

All natural-language instructions, labels, and example outputs are specified only in Chinese, including responder guidance and hotline references, with no indication that users may select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script is presented as a human trauma/stress detection tool for emergency shelters, but its runtime interface and internal control flow still rely on a generic 'pet_type' mechanism. In a high-stakes mental-health triage context, this mismatch can cause misconfiguration, misleading outputs, or use of an inappropriate underlying model, creating unsafe clinical or operational decisions rather than just a cosmetic bug.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents the tool description, argument help text, and operational messages entirely in Chinese, with no option for the user to select another language or locale. That is a natural-language policy issue because it imposes a specific language on all users rather than offering choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2