High-Risk Behavior Identification & Analysis Tool | 高风险行为识别分析工具

• Outcome: Review
• Latest audit: Aug 25, 2026 · 2:39 AM UTC
• Version: 999.999.1005

Overview

This skill mostly matches its risk-analysis purpose, but it uploads sensitive media and silently creates or reuses cloud-linked identity and token data, so it belongs in Review before installation.

Install only if you are comfortable sending videos, images, stream URLs, identity-linked report metadata, and generated report history to the configured lifeemergence.com cloud services. Review who controls the workspace data directory and local SQLite token store, and avoid using this skill with private medical, household, or camera footage unless the deployment has an appropriate privacy and retention policy.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 74% confidence
• Finding: This method builds filters from arbitrary keys using getattr(self.__model__, key) without validating that the key is an approved field. If untrusted input reaches filters, callers can query on unintended columns and potentially expose or enumerate data fields outside the intended API surface.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 72% confidence
• Finding: The count() method repeats the same unchecked dynamic column access pattern as list(). If external input controls filters, it can be used to probe schema details or count records based on sensitive/internal fields, enabling information disclosure and enumeration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no explicit permissions while its documented behavior requires shell execution, network access, local file reads/writes, and environment-derived identity handling. This mismatch weakens user and platform visibility into what the skill can actually do, increasing the chance of over-privileged execution and unsafe trust decisions.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The documentation says the system will silently receive, reuse, or create local default user identity information and associate reports to that identity. For a risk-analysis skill, hidden identity persistence is unrelated to core media analysis and creates privacy and account-linkage risk, especially when combined with cloud report queries.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest presents a media risk-analysis tool, but the body also describes cloud history retrieval, local logging, and persistent identity association. This scope expansion is security-relevant because it introduces data retention and remote data access behaviors beyond what a user might infer from the manifest alone.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file exposes generic HTTP and CRUD wrapper methods (`add`, `edit`, `delete`, `http_post`, `http_put`, `http_get`, `http_delete`) that are not constrained to the stated video/image risk-analysis purpose. In an agent skill, such broad remote-call capability increases the attack surface and can be repurposed for unintended data access or remote state changes if higher-level code passes attacker-influenced URLs or payloads.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The presence of remote modification primitives (`add`, `edit`, `delete`) is inconsistent with a skill described as analyzing images/videos for health or behavioral risk. Even if not immediately exploitable in this file alone, these methods enable external state changes and could be abused by surrounding code to modify or delete remote resources unrelated to the user’s expected task.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The utility layer performs user provisioning, token acquisition, local token persistence, and authenticated API login flows that are unrelated to the declared video/image risk-analysis purpose. In skill context, this is dangerous because invoking the skill can silently create or reuse identities, obtain tokens, and act against backend services without clear user consent, expanding the skill from analysis into account and session management.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill describes transmitting anomaly footage, risk type, location information, and notifications via app, SMS, and voice channels, but does not present a clear privacy warning or consent boundary. Because the content concerns medical and behavioral risk detection, the data is highly sensitive and unauthorized transmission could expose health, location, and surveillance information.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill says uploaded attachments or media files are automatically saved locally without clearly warning the user about storage, retention, or access controls. For sensitive videos and images involving health or safety monitoring, silent local persistence increases the risk of unintended disclosure and forensic residue.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When a local path is provided, the code reads the entire file into memory and uploads it to a remote analysis service, but this file does not provide any user-facing disclosure, consent prompt, or indication that local media will leave the device. In a health-risk video analysis skill, uploaded files are likely to contain highly sensitive personal or medical imagery, so silent transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code reads a workspace identity file (data/smyx-api-key.txt) to derive an internal identity/open-id without any user-facing disclosure, confirmation, or provenance checks. In this skill context, silent identity harvesting is more dangerous because the manifest describes health/risk analysis, not credential or identity reuse, so users would not reasonably expect local identity material to be consumed.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The request wrapper automatically attaches tokens, API keys, tenant data, and username/open-id fields to outbound HTTP requests, and may also bootstrap tokens if missing. This creates undisclosed external transmission of identity and authentication material, which is especially risky for a skill advertised as media-based risk analysis because the networked account behavior is outside expected functionality.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 94% confidence
• Finding: This outbound POST sends openId, mobile, source, and registration/login flags to an external health endpoint as part of automatic account provisioning. External transmission alone is not always a flaw, but here it is undisclosed, identity-linked, and unrelated to the skill's stated analysis purpose, making it a genuine privacy/security concern.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2