Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a remote facial-analysis skill, but it needs review because it can upload sensitive videos, silently bind activity to a local/cloud identity, and persist service tokens without clear user control.
Install only if you are comfortable sending facial videos or supplied video URLs to the Life Emergence remote service for health-style analysis and having report history associated with an automatically managed identity. Prefer use with non-sensitive, consented media, and review token storage, dependency pinning, and endpoint scoping before production or regulated use.
skills/smyx_common/scripts/util.py:568Authentication Credentials Can Be Forwarded to Arbitrary Request Origins and Are Persisted in Plaintext
requirements.txt:1Incorrect Root Dependency Name Creates Dependency-Confusion Risk
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The reported behavior includes local file operations, identity material reads, local DAO operations, automatic user registration/login, generic authenticated HTTP access, token persistence, and debug logging—far broader than the stated face-diagnosis workflow. In the context of medical video analysis, this is especially dangerous because it combines sensitive content with identity linkage, persistent auth state, and opaque remote interactions.
The YARA hit for metadata/tool poisoning indicators suggests the manifest may contain suspicious formatting or content designed to influence tooling or evade normal review. In combination with the extensive description-behavior mismatches, this raises concern that metadata is being used to misrepresent the skill's true capabilities.
---
name: "face-analysis"
description: "Supports uploading local MP4 videos or network video URLs to call the server-side API for facial diagnosis. It returns structured TCM facial diagnosis results. | 支持通过上传本地 MP4 视频或网络视频 URL，调用服务端 API 进行面部诊断，返回结构化的中医面诊结果"
version: "1.0.6"
license: "MIT-0"
---
# 🧑⚕️ TCM Facial Diagnosis Analysis Tool | 中医面诊分析工具
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询
---
## 🧭 技能概览 | Overview
| 模块 | 内容 |
|---|---|
|
The default trigger activates for generic video or file analysis requests whenever the user has not explicitly asked for other kinds of analysis. This can cause the agent to send videos or URLs to a server-side health-analysis workflow without sufficiently specific user intent, increasing privacy and consent risks.
The skill manifest describes facial diagnosis over uploaded or remote videos, but this configuration redirects analysis calls to pet health-analysis endpoints. This mismatch can cause the skill to process the wrong data domain, send user media to an unintended backend workflow, or return misleading medical-style results, creating a serious integrity and privacy risk. In a health-related skill, incorrect endpoint wiring is more dangerous because users may rely on inaccurate diagnostic output.
The skill manifest declares executable behavior involving shell, file I/O, environment access, and network/API usage, but does not constrain those capabilities with explicit tool scope metadata. In an agent setting, this increases the risk of unintended or overly broad tool use and makes review, sandboxing, and policy enforcement harder.
The skill name, core goal, trigger rules, workflow, and examples are primarily written to operate in Chinese terms and phrases, but the document does not state that this locale is optional or region-specific. Because there is no explicit user choice or opt-in for language/locale, this may violate language policy expectations.
The description emphasizes analysis features but does not clearly warn users that local videos or supplied URLs are transmitted to a server-side API for processing. For sensitive biometric and health-adjacent data, lack of explicit transmission disclosure undermines informed consent and increases data-exposure risk.
The documentation instructs users to upload facial videos or provide public video URLs to a remote server for analysis, but it does not disclose privacy risks, biometric sensitivity, retention, sharing, or consent requirements. Because facial video is highly sensitive biometric/health-adjacent data and the skill returns diagnosis-style results, omission of privacy and handling guidance can lead to unsafe collection, transfer, and processing of regulated personal data.
The inline comment describes the file as a pet health diagnosis analysis tool, which contradicts the declared face-analysis skill purpose. While a comment alone is not executable, this inconsistency is a strong indicator of copy-paste or component-reuse errors that can conceal functional misrouting to the wrong service, especially when paired with the endpoint mismatch in this file.
The function forwards either a local video path or remote video URL to skill.get_output_analysis(...), which the skill description states invokes a server-side API, but the script provides no explicit warning that potentially sensitive biometric/medical video data will be transmitted off-host. In this context, face-analysis data is especially privacy-sensitive, so lack of informed disclosure increases the risk of unintended exfiltration of local content or third-party URLs.
The script resolves an internal/open ID automatically via OpenIdUtil.resolve_current_open_id(...) without clear user-facing disclosure or consent at runtime. Because this skill handles medical-style face analysis and history lookup, silently binding requests to a user identity can expose or retrieve sensitive personal data under an identity the user did not explicitly choose.
Multiple returned user-facing strings are hard-coded in Chinese, such as the analysis header and export-link text, and the file does not provide any opt-in or locale selection. This creates a language-policy issue because the skill imposes a specific language on all users regardless of preference or context.
When a local path is provided, the code reads the entire file and uploads it to a server-side API (files = {'file': ...}) without any user-facing confirmation, warning, or explicit consent mechanism in this file. In a skill that handles local media, this creates a real privacy and data-exfiltration risk, especially if users may not realize their local video contents are transmitted off-host for analysis.
The method name SMYX_HYDROPONIC_NUTRIENT_ASSESSMENT_ANALYSIS describes an unrelated hydroponic nutrient assessment capability, while its docstring and implementation clearly operate on facial diagnosis report history. This is an active contradiction in developer-facing intent signals and can mislead auditors or downstream tooling about the skill's true purpose.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response