Anxiety-Related Behavior Recognition (Hand-rubbing / Nail-biting / Pacing) | 焦虑症相关行为（搓手、咬指甲、来回踱步）识别

• Outcome: Review
• Latest audit: Oct 17, 2026 · 11:22 AM UTC
• Version: 1.0.7

Overview

This skill needs Review because it handles sensitive anxiety-related home or office video through cloud services while silently creating or reusing an identity and storing account tokens locally.

Install only if you are comfortable sending sensitive home, office, school, or counseling-room video and identity-linked metadata to the configured cloud service. Require informed consent from recorded people, avoid covert or workplace/school monitoring, and check how to delete or switch the local identity, tokens, uploaded videos, and historical reports before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The described code capabilities include remote HTTP communication, token/authorization handling, user lookup/creation, local persistence, and directory/file access, all well beyond the user-facing claim of narrow video behavior analysis. In a mental-health context, this gap is dangerous because it enables sensitive identity and behavioral data processing without sufficiently informed consent or constrained privilege boundaries.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "smyx-anxiety-behavior-recognition-analysis"
description: "Using a fixed camera at home or in the office, the system analyzes daily videos of an individual (e.g., adult, adolescent) and detects anxiety-related behaviors: hand rubbing (repeated rubbing of both hands), nail biting (hand approaching mouth with biting motion), and pacing (repeated back-and-forth walking in a small area). | 通过家庭或办公室的固定摄像头，分析个体（如成人、青少年）的日常行为视频，检测手部搓揉（双手反复摩擦）、指甲啃咬（手部靠近嘴部并有啃咬动作）、来回踱步（在狭小区域内反复折返�

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The default and keyword-based auto-triggering is overly broad for a skill that infers anxiety-related behaviors from intimate home/office video. Broad triggering can cause the system to process highly sensitive mental-health content without sufficiently specific user intent, increasing the risk of non-consensual analysis and inappropriate uploads.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill does not prominently warn users that sensitive mental-health video may be uploaded to cloud/API services and that attachments may be saved locally. Without explicit notice, users cannot provide informed consent about transmission, storage, and privacy risks associated with highly personal behavioral footage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatically creating and reusing a local default identity for a mental-health behavior analysis skill risks silent account linkage and persistence of sensitive data across sessions. This is especially dangerous in shared devices or household/office environments, where users may unknowingly access or append to another person's historical records.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is designed for continuous camera-based monitoring in highly sensitive environments including homes, offices, classrooms, and counseling rooms, and it analyzes behaviors associated with anxiety. Without a clear upfront surveillance notice, consent model, and privacy impact guidance, the capability can enable covert monitoring, workplace/school overreach, and collection of sensitive behavioral inferences without meaningful user awareness.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code reads API-key/open-id material from the workspace, generates persistent default identities, and stores them for reuse across sessions. For a skill advertised as behavior recognition from a fixed camera, silent persistence of cross-session identity state is unnecessary and increases the risk of tracking, impersonation, and reuse of credentials beyond the user's expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The utility performs remote account provisioning, token acquisition, and authenticated API communication that are unrelated to the declared purpose of local anxiety-behavior video analysis. In this context, hidden identity enrollment and outbound tokenized traffic materially expand data exposure and create a covert channel for transmitting user-linked information off-device.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares no explicit tool scope or permissions even though the manifest instructs use of shell execution, local file handling, network access, and environment-backed identity flows. In a sensitive mental-health/video context, this under-specification prevents operators and users from understanding what the skill can access and increases the chance of over-privileged execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill adds cloud historical-report querying that goes beyond the headline purpose of analyzing an input video. Because those reports are linked to a user identity and relate to mental-health behavior, the extra retrieval capability expands exposure of sensitive historical data and may surprise users who expected one-time analysis only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The note requires attaching a single hotline number '400-161-9995' and advising prompt medical care whenever a 'high' level appears or certain symptoms are mentioned. This imposes a specific locale-dependent support resource without user opt-in or indication that the skill is limited to that region, which can violate language/locale policy expectations for general-use skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The API documentation exposes operations for querying historical anxiety-behavior records and exporting full reports, which are highly sensitive mental-health-adjacent data. Although the document mentions API key authentication, it does not pair these endpoints with explicit consent, access-control, minimization, or audit requirements, increasing the risk of privacy-invasive use or unauthorized disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The output specification hardcodes Chinese-language self-care messaging and a China-specific hotline without indicating locale scope, language selection, or fallback behavior. In a mental-health-related workflow, this can misdirect users in other regions, reduce comprehension in urgent situations, and create unsafe support guidance if the referenced resource is unavailable or inappropriate for the user's location.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill manifest is specifically about recognizing human anxiety-related behaviors in home or office video. In contrast, the implementation accepts pet_type values such as cat and dog and assigns them into ConstantEnum.DEFAULT__PET_TYPE, which does not match the described human-focused behavior-analysis scope.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2