TCM Facial Diagnosis Analysis Tool | 中医面诊分析工具

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:27 AM UTC
• Version: 1.0.5

Overview

The skill performs its stated face-analysis function, but it also silently creates or reuses an identity, registers/logs in remotely, and stores tokens while handling sensitive face-health media.

Install only if you are comfortable sending face videos or public video URLs to the provider's remote service and allowing the skill to create/reuse a local identity, register/login remotely, and store reusable auth tokens in the workspace data directory. Prefer explicit confirmation before analysis or history lookup, and avoid submitting third-party or sensitive videos without consent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to read local files, save attachments, invoke shell commands, access environment-backed identity handling, and make network requests, yet declares no explicit permissions. This creates a trust gap: an agent or reviewer may underestimate the skill's operational reach, increasing the risk of unintended file access, data exfiltration, or command execution in contexts where such capabilities should be gated.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is advertised as performing facial diagnosis on uploaded videos or video URLs, but the configuration rewires requests to `/web/health-analysis/...` pet-health endpoints and even labels the file as a pet health analysis tool. This kind of intent/configuration mismatch is dangerous because users and reviewers may believe they are invoking one type of analysis while the backend actually sends sensitive media to a different service, creating unauthorized data handling, privacy, and compliance risk.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The inline comment identifies the file as a pet health diagnosis configuration while the skill metadata claims facial diagnosis functionality. Even if this began as a copy/paste or maintenance error, contradictory documentation materially increases the risk of misrouting sensitive uploads, misleading operators, and hiding improper backend use during review.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill exposes a face-diagnosis report-listing capability through a misleading function name, `SMYX_HYDROPONIC_NUTRIENT_ASSESSMENT_ANALYSIS`, which does not match its actual behavior. Misnamed capabilities can evade review, confuse callers and policy layers, and accidentally expose sensitive report metadata or links through an interface that appears unrelated.

Intent-Code Divergence

High

• Confidence: 92% confidence
• Finding: The method name suggests hydroponic nutrient assessment while the implementation and docstring operate on facial diagnosis reports, creating an intent/behavior mismatch. In security-sensitive agent systems, this kind of semantic deception can bypass governance, user consent expectations, or tool-allowlisting based on names and descriptions, increasing the risk of unauthorized access to health-related data.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module exposes broad generic HTTP and CRUD wrappers (`http_get`, `http_post`, `http_put`, `http_delete`, `add`, `edit`, `delete`, `page`, `list`) that are not constrained to the skill’s stated facial-diagnosis purpose. In a skill that should only upload videos and retrieve diagnosis results, these helpers expand the reachable attack surface and can be repurposed by other skill components to access or modify unrelated backend resources, making abuse and policy bypass easier.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The `add`, `edit`, and `delete` methods provide unrestricted resource-modification primitives despite the manifest describing a read/analyze-oriented face diagnosis capability. In context, these mutation helpers are unjustified and could be used by dependent code to alter backend data or trigger side effects unrelated to diagnosis, especially because they simply forward arbitrary URLs and arguments to `RequestUtil.http_post` without visible validation.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The module defines persistent local storage for user/account records, including identifiers and account-like metadata, which is broader than the stated face-analysis purpose of uploading videos and returning diagnosis results. In a skill context, collecting and retaining extra identity data increases privacy risk, expands breach impact, and suggests unnecessary data accumulation without clear purpose limitation.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The User model stores identity fields such as username, realname, email, birthday, age, and especially token/open_token values, despite the skill description focusing on facial diagnosis from uploaded video. Storing authentication tokens and personal profile data without a clear need creates a materially larger compromise surface, and if the local database is accessed, attackers could recover both PII and reusable credentials.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This utility file includes agent workspace discovery, skills-directory creation, local identity resolution, and default-user provisioning logic that goes well beyond the advertised facial-analysis function. That mismatch expands the skill's authority and makes it capable of touching broader local state and identity data without clear user disclosure or necessity.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The HTTP helper can silently auto-register or log in a user by sending a derived username/openId to a health endpoint before performing normal API requests. For a face-analysis skill, undisclosed account creation and authentication behavior is materially different from the stated purpose and can transmit identifiers and create persistent remote accounts without informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code can compute, create, and use the agent's skills directory, enabling modification or population of the broader skill environment. That capability is unjustified for a face-analysis tool and increases the blast radius if the skill is abused or later extended to write additional content there.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill reads internal identity from a local API-key file and local user database, then uses that to resolve a current open-id. For a face-analysis feature, harvesting and reusing local identity state is outside expected behavior and creates privacy and account-misuse risks, especially when later combined with outbound requests.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The default trigger condition is broad enough to auto-activate on generic requests involving uploaded videos or URLs, even when the user may not have intended medical-style face analysis. Over-broad activation increases the chance of processing sensitive biometric/health-related content without sufficiently clear user consent or task confirmation.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The historical report query is triggered by very common phrases such as viewing reports or lists, without strong scoping to this skill or clear confirmation. In a system that auto-associates identity internally, such broad triggers could cause unintended retrieval of sensitive prior health reports.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API documentation explicitly supports uploading local face videos or providing public video URLs for facial diagnosis, but it does not warn about the collection and processing of highly sensitive biometric and health-related data. In this skill context, that omission is meaningful because users may submit identifiable videos and inferred medical information without being informed about privacy risks, retention, consent, or third-party access, increasing the chance of misuse or non-compliant handling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id without clearly informing the user that a hidden identifier will be derived and used. In a skill that uploads or references personal video data for facial diagnosis, silent identity binding increases privacy risk, enables unexpected account linkage, and may cause requests or history queries to run under an identity the user did not knowingly select.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The analyze_video flow passes either a local file path or remote URL into skill.get_output_analysis, which the skill description indicates sends to a server-side API for diagnosis, but the script does not provide an explicit user-facing disclosure at the point of action. Because the content is facial video data, this can expose sensitive biometric and health-related information to a remote service without sufficiently informed user consent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code reads arbitrary local file content and uploads it to a server-side analysis API, but this file contains no user-facing disclosure, confirmation step, or minimization control before transmission. Because the skill handles local media and produces health-related analysis, silent upload can expose sensitive biometric and personal data beyond what a user may reasonably expect.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code transmits either a local video file's full contents or a user-supplied remote video URL to a server-side analysis API, but this file contains no user-facing notice, consent check, or privacy disclosure before sending potentially sensitive biometric data. Because the skill performs facial diagnosis, the data is especially sensitive and may expose personal health-related or identifying information if users are unaware it leaves the local environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code retrieves an identifier from environment/workspace-derived state and treats it as the current open-id, later enabling network transmission of that identity. Sending environment-derived identity without clear notice or consent is a privacy and transparency problem, especially in a skill that users expect to only analyze face videos.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request helper attaches tokens and user identity fields such as X-Access-Token, X-Api-Key, Authorization, and pnaUserName to outbound requests. In the context of a face-analysis skill, this is sensitive data transmission that is not obvious from the description and could expose persistent credentials or correlate user activity across services.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 96% confidence
• Finding: requests.post(_url, json=

Hidden Instructions

High

• Category: Prompt Injection

Content

license: "MIT-0"
---

# 🧑‍⚕️ TCM Facial Diagnosis Analysis Tool | 中医面诊分析工具
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询

---

• Confidence: 77% confidence
• Finding: ‍

Hidden Instructions

High

• Category: Prompt Injection

Content

|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 视频要求：支持 mp4/avi/mov 格式，最大 10MB |
| 🧑‍⚖️ 结果性质 | 分析结果仅供参考，不能替代专业医疗诊断 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段 reportImageUrl 作为超链接地址，且自动转化为如下 Markdown |

• Confidence: 77% confidence
• Finding: ‍

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2