Adult Facial Fatigue / Stress Index | 成人面部疲劳/压力指数分析

• Outcome: Review
• Latest audit: Oct 11, 2026 · 9:44 PM UTC
• Version: 1.0.11

Overview

The skill does facial fatigue analysis, but it sends sensitive face media to a cloud service while silently creating/reusing identities and storing tokens locally with limited user control.

Install only if you are comfortable with adult face images or videos being processed by the configured cloud service and linked to a silent local/cloud identity. Before use, confirm consent from the person in the media, understand that local tokens and report history may persist, and avoid using highly sensitive or third-party face media unless retention and deletion expectations are clear.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (51)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to automatically generate and persist identities/open IDs, read API keys or identifiers from workspace files, and perform authenticated remote API access while presenting itself as a simple facial-fatigue tool. In the context of biometric image handling, hidden identity binding and local credential storage create a serious risk of cross-session tracking, unauthorized report access, and exposure of sensitive face-linked records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to automatically generate and persist identities/open IDs, read API keys or identifiers from workspace files, and perform authenticated remote API access while presenting itself as a simple facial-fatigue tool. In the context of biometric image handling, hidden identity binding and local credential storage create a serious risk of cross-session tracking, unauthorized report access, and exposure of sensitive face-linked records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to automatically generate and persist identities/open IDs, read API keys or identifiers from workspace files, and perform authenticated remote API access while presenting itself as a simple facial-fatigue tool. In the context of biometric image handling, hidden identity binding and local credential storage create a serious risk of cross-session tracking, unauthorized report access, and exposure of sensitive face-linked records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to automatically generate and persist identities/open IDs, read API keys or identifiers from workspace files, and perform authenticated remote API access while presenting itself as a simple facial-fatigue tool. In the context of biometric image handling, hidden identity binding and local credential storage create a serious risk of cross-session tracking, unauthorized report access, and exposure of sensitive face-linked records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to automatically generate and persist identities/open IDs, read API keys or identifiers from workspace files, and perform authenticated remote API access while presenting itself as a simple facial-fatigue tool. In the context of biometric image handling, hidden identity binding and local credential storage create a serious risk of cross-session tracking, unauthorized report access, and exposure of sensitive face-linked records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to automatically generate and persist identities/open IDs, read API keys or identifiers from workspace files, and perform authenticated remote API access while presenting itself as a simple facial-fatigue tool. In the context of biometric image handling, hidden identity binding and local credential storage create a serious risk of cross-session tracking, unauthorized report access, and exposure of sensitive face-linked records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to automatically generate and persist identities/open IDs, read API keys or identifiers from workspace files, and perform authenticated remote API access while presenting itself as a simple facial-fatigue tool. In the context of biometric image handling, hidden identity binding and local credential storage create a serious risk of cross-session tracking, unauthorized report access, and exposure of sensitive face-linked records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to automatically generate and persist identities/open IDs, read API keys or identifiers from workspace files, and perform authenticated remote API access while presenting itself as a simple facial-fatigue tool. In the context of biometric image handling, hidden identity binding and local credential storage create a serious risk of cross-session tracking, unauthorized report access, and exposure of sensitive face-linked records.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-adult-facial-fatigue-stress-index-analysis"
description: "Using a smart mirror or fixed camera, the system analyzes high-resolution adult facial images or short videos to detect physiological features such as under-eye bag area (puffiness/shadow under the lower eyelid), dark-circle grayscale (darkness around the eyes), mouth-corner drop angle (angle between corner of mouth and horizontal), and glabellar frown lines (vertical lines between the brows), and computes a comprehensive. | 通过智能镜子或固定摄像头，分析成人面部的高清图像或视频，检测眼袋面积（下眼睑区域的浮肿或阴影面积）、黑眼�

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that uploaded face images or videos are automatically saved locally, but it does not provide a clear user-facing retention notice, lifecycle policy, or deletion control. Since facial media is sensitive biometric data, silent local persistence materially increases the risk of privacy violations, unauthorized access, and secondary use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The User model stores token and open_token fields even though the manifest describes a local facial fatigue/stress scoring skill, not an authentication or account-linking service. Storing authentication-style tokens without clear necessity expands the blast radius of any local compromise and creates credential leakage and cross-service access risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This utility layer reads, derives, stores, and reuses user identity and token-related data, including values from a workspace credential file and local database, despite the declared purpose being facial fatigue/stress analysis. That creates unnecessary collection and persistence of sensitive identity material, expanding the privacy and security footprint and enabling silent account linkage or impersonation if the workspace or database is accessed by other code.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The request path silently performs account login/registration against an external health service using generated or recovered identifiers. For a skill advertised as local facial-fatigue analysis, this is unjustified hidden behavior that can create remote accounts, transmit identity data off-device, and couple the user to an external service without clear consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and instructs use of shell, network, filesystem, and environment-backed capabilities but does not declare any explicit tool scope or permissions boundaries. This weakens least-privilege controls and makes it easier for the skill to access sensitive local data or invoke external services beyond what a user would reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default trigger activates on essentially any uploaded adult face image or video, which can cause unintended processing of sensitive biometric data without a sufficiently explicit user request. In a face-analysis skill, overbroad invocation is more dangerous because users may expose private health-adjacent inferences and images accidentally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Broad keyword triggers such as general fatigue, stress, or report-related phrases can invoke the skill outside the user's actual intent and may cause unexpected biometric processing or cloud report access. Because the skill handles face data and historical reports, accidental activation carries elevated privacy consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing string on this line is hard-coded in Chinese, which indicates the skill presents output in a specific language without any visible opt-in, selection mechanism, or documented locale constraint in this file. This is a natural-language policy concern because it may impose a language on users regardless of their preferred locale.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and surrounding CLI documentation consistently describe analysis of adult human faces for fatigue/stress features. However, these lines define a '--pet-type' argument with choices 'cat', 'dog', and 'other', which directly contradicts the stated human-only purpose and indicates reused or mismatched intent documentation in code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This skill processes sensitive facial images/videos and appears capable of accepting remote URLs or API endpoints without presenting any privacy notice, consent flow, or transmission warning. In this context, users may unknowingly send biometric or health-adjacent data to external services, increasing the risk of privacy violations, noncompliant data handling, and inadvertent disclosure of highly sensitive media.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 28)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/smyx_analysis/scripts/skill.py (reported line 33)May include surrounding context.

python

result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)

        result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
                                                                                           dict) else result_json
        if result_json_common_ai_response:
            result_json = result_json_common_ai_response

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest frames the skill as analyzing images or short videos obtained from a smart mirror or fixed camera setup for facial fatigue/stress assessment. The code additionally supports direct ingestion of any HTTP/HTTPS URL as input, which broadens the behavior from local/camera-captured media analysis to remote content fetching by reference.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill reads arbitrary local file contents and transmits them to the analysis service without any consent prompt, contextual warning, or narrowing to a trusted capture source in this file. In a privacy-sensitive facial-analysis skill, this creates a meaningful risk of unintended exfiltration of sensitive local media if the caller passes an unexpected path.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script exposes a historical analysis listing feature via show_analyze_list(open_id) that is not necessary for the stated single analysis use case and increases access to potentially sensitive prior biometric/health-related results. In this context, historical facial fatigue/stress analyses are privacy-sensitive, so any unnecessary retrieval surface raises the risk of unauthorized disclosure if open_id handling or backend authorization is weak.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a narrowly scoped skill that analyzes adult facial imagery/videos for specific facial features and computes a fatigue/stress index. In contrast, the user-facing code presents itself as a generic "video analysis tool" and adds a history-listing mode, with no visible implementation or documentation of the specific facial metrics or index computation claimed by the manifest.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2