Back to skill

Security audit

Trauma Stress Behavior Detection (Emergency Scene) | 受灾人群心理创伤行为识别(应急场景)

Security checks across malware telemetry and agentic risk

Overview

The skill broadly matches its stated video-analysis purpose, but it needs Review because it sends sensitive shelter footage to cloud services while silently creating, reusing, and storing identity/token data.

Install only in an authorized emergency-response setting after reviewing the configured endpoints, especially the dev/private HTTP URLs. Treat use of this skill as remote processing of sensitive shelter footage and crisis reports, and confirm consent/legal authority, tenant scoping, retention limits, face blurring, and secure credential storage before using real footage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (19)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill directs the agent to use shell execution, local file handling, environment-derived identity handling, and network access, yet it declares no explicit permissions or trust boundaries. This creates a capability mismatch that can cause the platform or user to underestimate what the skill can access, increasing the risk of unintended file access, remote data transfer, or command execution.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS video URLs, which expands its operational scope beyond the stated fixed-camera emergency-shelter workflow. This can enable analysis of external or untrusted video sources, creating policy, privacy, and misuse risks because the code does not restrict source domains, camera provenance, or deployment context.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The report-listing function exposes access to prior analysis records, which is broader than the advertised single-purpose behavior-detection workflow. In a disaster-shelter mental-health context, report metadata and contents may be sensitive, so listing them without clear authorization checks in this code increases the risk of unauthorized disclosure.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file exposes broad generic API capabilities (arbitrary POST/PUT/GET/DELETE wrappers plus CRUD-style helpers) that are not clearly necessary for a skill whose stated purpose is fixed-camera trauma/stress behavior detection. In an agent-skill context, this kind of overbroad network surface can be repurposed to access unrelated services, exfiltrate data, or invoke unintended backend actions, especially because the methods accept caller-supplied URLs and payloads with little visible restriction.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The ability to look up users by username is unrelated to the declared function of detecting acute stress behaviors from shelter camera footage. In this context, the feature expands access to identity-related data without an evident operational need, creating unnecessary privacy and enumeration risk if the skill or its callers are abused.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This module implements generic user/account persistence, including creation, update, lookup, and deletion of user records, despite the skill being described as crowd trauma/stress behavior video analysis. That mismatch indicates unnecessary data handling capability and expands the privacy and misuse surface by enabling local identity database management unrelated to the stated purpose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The User model stores direct identifiers and authentication-adjacent data including username, realname, email, birthday, age, token, and open_token. For a fixed-camera crowd stress detection skill, retaining identity and token fields is disproportionate and increases the consequences of unauthorized access, repurposing, or accidental disclosure.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility code performs authenticated outbound API access and implicit account bootstrap logic that is unrelated to the declared purpose of analyzing shelter video for acute stress behaviors. It can transmit identity and token material, couple the skill to an external service, and enable actions under a local or auto-created identity without clear operator consent; in a humanitarian setting, that mismatch raises serious privacy and unauthorized-data-flow concerns.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code automatically resolves, creates, and persists local identities, and may later use them to access remote services, despite this having no clear necessity for simple video-behavior detection. Silent identity creation increases the risk of hidden tracking, unauthorized account generation, and attribution of actions to fabricated or undeclared users. In a disaster-shelter context involving vulnerable populations, undisclosed identity handling is especially sensitive.

Context-Inappropriate Capability

Medium
Confidence
78% confidence
Finding
The workspace-discovery logic inspects environment variables and filesystem paths to locate and create agent data and skills directories. While this may be framework plumbing rather than overtly malicious, it expands the skill's operational scope beyond its declared video-analysis function and can facilitate persistence, file writes, or interaction with other agent resources without clear need. That unnecessary filesystem awareness is more concerning in a sensitive deployment environment.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill auto-triggers cloud history queries from broad natural-language phrases like requests to view reports, without clear exclusion conditions, authorization checks, or narrow scoping. In a sensitive mental-health monitoring context, this can expose historical incident data more easily than intended and cause over-collection or disclosure of private records.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill instructs automatic saving of uploaded media and mandatory cloud/API queries, but it does not clearly warn users that sensitive shelter video and historical mental-health alert data may be transmitted to remote services. Because the content involves vulnerable disaster victims and inferred psychological states, missing disclosure materially increases privacy, consent, and compliance risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code reads arbitrary local file content and uploads it to the analysis service without any visible user disclosure, consent step, or minimization controls in this component. Because the skill processes sensitive video from emergency shelters and psychological-crisis contexts, silent transmission can lead to privacy violations and accidental exfiltration of highly sensitive footage.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code reads a sensitive identity value from data/smyx-api-key.txt without any user-facing disclosure, validation, or consent flow. This can silently bind the skill's actions to a hidden identifier and is particularly problematic in a crisis-response setting where operators may assume the skill only performs local behavioral analysis.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
This request path sends usernames, tokens, open tokens, and related metadata in outbound HTTP requests without any user-facing disclosure about what is being transmitted or why. Undisclosed transmission of identity/authentication data is dangerous on its own, and the risk is amplified here because the skill's public purpose is behavioral video analysis in emergency shelters, not remote account-linked API activity.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
97% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
| 🔎 使用提醒 | 应急救援场景采用"**宁可多触发不可漏报**"原则,但高危预警必须**人工复核**后再升级到救援调度,避免误判造成现场骚动 |
| 🔎 使用提醒 | 儿童 / 老人 / 孕妇 / 残障人士等脆弱群体阈值降一档,系统更敏感 |
| 🔎 使用提醒 | 应注意区分正常疲倦休息(静坐)与木僵:木僵需 ≥ 5 分钟且对外界刺激**无响应** |
| 🧑‍⚖️ 结果性质 | 红线约束:**禁止**输出 ASD / PTSD 等临床诊断;**禁止**给予药物建议;**禁止**长期存储原始视频(≤ 7 天清理,仅留聚合事件日志);**禁止**将受灾人群视频用于媒体传播 / 社交媒体 / 商业研究 |
| 🔎 使用提醒 | 公共指挥屏展示必须做**面部模糊化**处理(保护受灾者尊严) |
| 🔎 使用提醒 | 合规要点:必须经由**应急指挥中心 / 卫健委授权部署**,配合**现场持证心理救援人员**(中国心理学会临床心理学注册委员会注册人员、红十字心理救援队等)使用;遵守《突发事件应对法》《精神卫生法》 |
| 📁 格式支持 | 任何预警都附 **PFA 6 步要点**(建立连接 → 安全保障 → 平静化 → 联系亲友 → 实际支持 → 转介资源)+ 转介资源(当地精神卫生中心 / 12320 / 400-161-9995) |
Confidence
76% confidence
Finding

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2