Security audit
Security checks for vulnerabilities and agentic risk
This cloud media risk-analysis skill has coherent core functionality, but it ships with unsafe defaults for sensitive video, identity, and token handling that require review before installation.
Install only if you trust this publisher and service with sensitive camera/video and health-related data, and only after changing the release configuration to approved HTTPS endpoints. Review the token storage behavior, avoid shared workspaces for credentials, and do not follow payment-skill installation prompts from error output unless that separate skill has been reviewed.
skills/smyx_common/scripts/config-dev.yaml:2Default development profile transmits sensitive media, identities, and authentication tokens over plaintext HTTP
skills/smyx_common/scripts/util.py:586Authentication tokens are persisted unencrypted in a shared workspace SQLite database
skills/smyx_common/scripts/util.py:658Remote billing response injects a directive to install and invoke an additional payment Skill
requirements.txt:3Incorrect and ambiguous YAML dependency declaration creates supply-chain and installation integrity risk
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
Automatic identity resolution, default account creation, authenticated remote login/registration, token persistence, and workspace inspection are highly sensitive behaviors that are not transparently reflected in a user-facing description of simple media risk analysis. In this context, the skill can silently bind user activity to accounts and transmit data to backend health services, creating serious privacy, consent, and abuse concerns if users or agents are unaware.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "risk-analysis"
description: "Supports identifying high-risk behaviors and health risks through video/images, including elderly falls, precursors to heart attacks and strokes, and abnormal behaviors, issuing timely warning alerts. | 高风险行为识别分析工具，支持通过视频/图片识别高危行为和健康风险，包括老人跌倒、心梗脑梗前兆、异常行为等，及时发出预警提示"
version: "1.0.13"
license: "MIT-0"
---
# ⚠️ High-Risk Behavior Identification & Analysis Tool | 高风险行为识别分析工具
> **智能分析中枢** · 图片/视频智能分析 · 结构�
This utility layer performs identity resolution, token management, auto-login/registration, and payment-balance handling that are unrelated to the stated purpose of video/image-based risk analysis. In a skill advertised for health-risk detection, hidden account provisioning and billing workflow logic significantly expands the trust boundary and can cause unauthorized external service use, unexpected account creation, and covert data transmission under the user's identity or a fabricated default identity.
The code silently posts to an external health service endpoint with register=1 and silent=1 to create or log in users automatically. That behavior is unjustified for the declared purpose of media-based risk detection and can create accounts, transmit identifiers, and obtain tokens without informed user authorization, making the skill materially more dangerous in context.
The skill advertises and instructs use of capabilities including shell execution, local file read/write, environment access, and network/API communication, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, this creates an overbroad execution surface where the model may invoke powerful capabilities without a clearly bounded policy, increasing the chance of unintended data access, command execution, or exfiltration.
The file instructs that users should express intent using fixed Chinese phrases such as “查看历史报告/报告清单” for report lookup. This imposes a specific language expectation without explicitly offering multilingual equivalents or user opt-in, which is a natural-language policy concern.
The skill encourages cloud history queries and remote URL analysis without a clear user-facing warning that uploaded media, report metadata, and possibly location/identity-linked information may be transmitted to remote services. For a skill dealing with elderly monitoring and health-risk indicators, that omission materially increases privacy and compliance risk because the data is especially sensitive.
This markdown file contains user-facing operational guidance exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may choose another language. The policy explicitly calls out forced language or locale without user opt-in as a natural-language policy violation.
The script resolves an internal user identity via OpenIdUtil.resolve_current_open_id(...) without clear disclosure, explicit consent, or a visible requirement in the CLI help. In a tool that processes sensitive health and behavioral video analysis, silently binding analysis requests and history listing to an internal identity can enable unintended tracking, privacy violations, or access to another user's analysis context if identity resolution is mis-scoped.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Several user-facing output strings are hardcoded in Chinese, such as the report header and export-link text, with no visible mechanism for language selection or user opt-in. This creates a locale policy concern because the skill appears to force a specific language regardless of user preference.
The manifest describes a risk-analysis tool for identifying dangerous behaviors and health risks from video/images, which implies analysis of supplied media. At L113-L116, the code also accepts arbitrary HTTP/HTTPS URLs and forwards them as videoUrl, introducing remote resource retrieval behavior not stated in the manifest.
The function reads the entire local file into memory and sends it to the analysis service without any consent prompt, disclosure, or minimization in this code path. In a health-risk analysis skill, uploaded media may contain highly sensitive personal or medical information, so silent transmission to a remote service creates a meaningful privacy and compliance risk.
This code emits user-facing CLI messages in Chinese, such as the required-argument error at L034, and similar strings also appear in the argument descriptions and status output. Because the skill does not offer a language/locale option or state that it is intentionally limited to a Chinese-speaking context, it creates a natural-language locale policy issue.
The skill advertises risk analysis on supplied media, but also exposes a history-listing function tied to an open_id that can return prior analysis records. If open_id resolution or authorization is weak elsewhere, this creates an unintended data exposure surface for potentially sensitive health or behavior-analysis history, which is especially risky given the medical/safety context of the skill.
This Python file issues HTTP requests via RequestUtil.http_post/http_put/http_get/http_delete, including sending caller-provided data such as tosKey and request payloads, but the file contains no confirmation prompt, logging, print statement, docstring, or comment disclosing that user or system data may be transmitted over the network. Under the code-file criteria for SQP-2, network transmission without any visible disclosure is reportable when no warning is present in the file.
Detected: suspicious.install_untrusted_source