ClawHub
Back to skill

Security audit

Adult Facial Fatigue / Stress Index | 成人面部疲劳/压力指数分析

Security checks across malware telemetry and agentic risk

Overview

The skill does the advertised facial fatigue analysis, but it also sends face media and identity-linked history requests to remote services while silently creating and reusing local user tokens.

Review this skill carefully before installing. It is not just local face analysis: it may upload face images or videos, create or reuse a backend-linked identity, store tokens in a local SQLite database, and retrieve cloud history. Use it only if users have consented to biometric processing and you are comfortable with the configured API services and local retention behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (24)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
82% confidence
Finding
This code uses user-supplied filter keys to dynamically select model attributes via getattr(self.__model__, key) with no allowlist or existence check. While this is not classic SQL injection because SQLAlchemy still parameterizes values, it can let callers query on unintended columns, trigger exceptions for bad attribute names, and expose or manipulate records based on sensitive/internal fields that should not be externally filterable.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
82% confidence
Finding
As in list(), dynamically resolving model attributes from arbitrary filter keys allows untrusted input to control which columns are used in count queries. This can enable unauthorized probing of internal schema/record properties and create denial-of-service style error conditions from invalid attribute names, especially in a skill handling sensitive biometric/stress-related user data.

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill declares no permissions while its documented behavior clearly requires shell execution, network access, and local file read/write. That mismatch prevents meaningful user or platform consent and obscures a sensitive capability set, especially because the skill handles biometric face media and account-related state.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The described purpose is facial fatigue scoring, but the behavior includes hidden identity bootstrap, token management, local SQLite persistence, and cloud history retrieval unrelated to simple image analysis. This broadens the trust boundary from local analysis to covert account handling and remote profile access, creating significant privacy and unauthorized-data-access risk for biometric and user identity data.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The script presents itself as a local adult facial fatigue/stress analyzer, but the actual analysis is delegated to a generic skill method with no visible validation of what processing occurs or where data is sent. In the same file it also exposes record-listing functionality tied to user identity, which expands the scope from local analysis to user data retrieval and creates a privacy and transparency risk for biometric data handling.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script resolves an internal user identity and supports listing analysis records by open ID even though the advertised purpose is one-off facial fatigue/stress analysis. Coupling sensitive biometric processing with hidden identity resolution and record retrieval increases the chance of unauthorized access to personal analysis history or unexpected user tracking.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill accepts arbitrary HTTP/HTTPS URLs and forwards them for analysis, which expands its operational scope beyond the stated smart-mirror/fixed-camera workflow. This can enable unintended remote-content processing, including privacy issues, misuse of backend fetch capabilities, or analysis of untrusted third-party media without clear user expectations.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This service exposes generic add/edit/delete and arbitrary http_get/http_post/http_put/http_delete wrappers that are not scoped to the stated facial fatigue/stress analysis function. In a skill handling sensitive biometric/health-adjacent facial data, this broad network capability can enable unintended data exfiltration, unauthorized backend actions, or use of the skill as a general-purpose proxy if higher layers pass attacker-controlled URLs or payloads.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file for a facial fatigue/stress analysis skill contains a broad-purpose HTTP wrapper that performs remote account lookup, login/registration, token handling, and arbitrary API calls unrelated to the stated biometric analysis function. This overbroad capability increases the attack surface and allows hidden data transmission or account-side effects far beyond what users would reasonably expect from an image-analysis skill.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This code resolves or creates persistent user identities, reads an identity from a local file, creates fallback users, and stores/reuses tokens, none of which is justified by a simple facial fatigue/stress scoring feature. In the context of a biometric skill, silent identity provisioning and token persistence materially raise privacy and account-abuse risks because sensitive user data can become linked to backend identities without informed consent.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The request wrapper includes payment and recharge workflow messaging that is unrelated to facial fatigue/stress analysis. Embedding monetization/account-billing behavior in shared utility code is dangerous because it normalizes hidden non-core side effects and can steer users into unrelated account actions from a biometric-analysis feature path.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The automatic trigger phrases for historical-report retrieval are broad enough that ordinary user wording could invoke cloud history access without deliberate intent. In this context, that can expose personal wellness history and linked reports derived from facial biometrics when the user may only be asking a general question.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill states that uploaded face images or videos are automatically saved as local files, but it does not clearly warn users about local retention, storage duration, or protection of biometric data. Because facial media is highly sensitive, silent local persistence materially increases privacy, leakage, and misuse risk.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill requires direct cloud API queries for historical reports without clearly informing users that their personal analysis history will be retrieved from a remote service. Given that the history is tied to facial-health analysis and hidden identity linkage, undisclosed remote retrieval creates serious privacy and transparency concerns.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The API documentation exposes an endpoint for exporting a full report by ID, but provides no warning about the sensitivity of the report contents or required authorization controls. In this skill's context, the exported data likely includes biometric-derived health or wellness assessments tied to an identifiable adult face, so weak access control or predictable IDs could lead to privacy-sensitive data disclosure.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This skill processes highly sensitive facial biometric and inferred wellness data but provides no privacy warning, consent flow, or disclosure about storage, transmission, or retention. Users may unknowingly submit intimate image/video data and derived stress/fatigue indicators without understanding how that sensitive data is handled.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code reads the full local file and uploads it to an external analysis service without any user-facing warning or explicit consent in this component. Because the skill processes sensitive facial images/videos, silent upload materially increases privacy risk and can surprise users about where biometric-related data is being sent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Debug mode enables full HTTP connection and urllib3 logging, which can expose request URLs, payloads, responses, and potentially tokens or user-identifying data in logs. In a biometric-analysis skill, this is especially sensitive because facial-analysis metadata and associated identity/account information may be transmitted and then captured in local or centralized logs.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The code silently reads an identity value from `data/smyx-api-key.txt` and treats it as the current open-id. Even if local-only, this creates undisclosed identity coupling and can cause requests from the biometric skill to be attributed to an internal or previously configured identity without user awareness.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The `_get_or_create_user` helper sends user-identifying values such as `openId`, `mobile`, and `source` to a remote endpoint for silent login/registration. In a skill advertised for facial fatigue/stress analysis, transmitting identifiers to create or recover backend accounts without a clear warning is a significant privacy and trust issue.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This general request wrapper sends request bodies together with authentication headers (`X-Access-Token`, `X-Api-Key`, `Authorization`) across arbitrary URLs composed at runtime. Without strong scoping and disclosure, this creates a risk of broad hidden data exfiltration or credential misuse, which is more concerning in a skill that processes sensitive biometric-related information.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
94% confidence
Finding
The explicit `requests.post` to `/sys/phoneLogin` transmits identity data externally, constituting a real external transmission path. In context, this is more dangerous because the skill's stated purpose is local-seeming facial state analysis, so hidden remote identity operations are unexpected and may violate privacy expectations or policy requirements.

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 输入要求：支持 jpg/png 图像或 mp4/avi/mov 短视频，最大 10MB；建议正面、光照均匀、无重度滤镜 |
| 🧑‍⚖️ 结果性质 | 评分结果仅作为个人状态参考，单次评分受光照/妆容影响较大，建议结合连续趋势查看；不替代专业医生评估 |
| 🔏 隐私合规 | 隐私合规：面部数据涉及生物特征隐私，使用前需取得本人同意，并妥善保管/加密相关图像 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网络地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
Confidence
84% confidence
Finding
The hidden-instruction indicator suggests the manifest may contain concealed or non-obvious control text affecting agent behavior. In a skill that already mixes sensitive biometric handling, shell execution, and cloud-linked history access, hidden instructions reduce auditability and can be used to steer the agent in ways not apparent to users or reviewers.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-adult-facial-fatigue-stress-index-analysis"
description: "Using a smart mirror or fixed camera, the system analyzes high-resolution adult facial images or short videos to detect physiological features such as under-eye bag area (puffiness/shadow under the lower eyelid), dark-circle grayscale (darkness around the eyes), mouth-corner drop angle (angle between corner of mouth and horizontal), and glabellar frown lines (vertical lines between the brows), and computes a comprehensive. | 通过智能镜子或固定摄像头，分析成人面部的高清图像或视频，检测眼袋面积（下眼睑区域的浮肿或阴影面积）、黑眼圈灰度（眼眶区域的暗沉程度）、嘴角下垂角度（口角与水平线的夹角）以及皱眉纹（眉间川字纹）等生理特征，综合计算疲劳/压力指数（0-100分）。该技能可用于职场健康管理、个人状态监测，辅助了解自身精力水平。"
version: "1.0.11"
license: "MIT-0"
---
Confidence
90% confidence
Finding
Tool/metadata poisoning indicators in the manifest are concerning because agent frameworks may ingest manifest text as trusted control data. When paired with hidden instructions and behavior mismatches, poisoned metadata can manipulate tool invocation, suppress scrutiny, or misrepresent what the skill actually does.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2