Back to skill

Security audit

Anxiety-Related Behavior Recognition (Hand-rubbing / Nail-biting / Pacing) | 焦虑症相关行为(搓手、咬指甲、来回踱步)识别

Security checks across malware telemetry and agentic risk

Overview

This skill analyzes sensitive anxiety-related videos but also uses cloud services, persistent identity, token caching, and report history in ways users should review carefully.

Install only if you are comfortable sending home/office video and anxiety-behavior results to the publisher's cloud service and linking them to a persistent account/report history. Before use, look for clear consent, retention/deletion terms, and a way to inspect or remove stored reports and local identity/token data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
77% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes scripting, local file handling, network access, shell execution, and environment usage but does not declare corresponding permissions or clearly bound those capabilities. This creates a transparency and least-privilege problem: reviewers and users cannot accurately assess what the skill can access, and hidden capability expansion is especially risky in a privacy-sensitive video-monitoring skill.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is limited to analyzing anxiety-related behaviors from videos, but the skill also describes cloud history retrieval, persistent identity creation/reuse, remote account and token handling, and report-link generation. This mismatch is dangerous because it hides sensitive identity and backend interactions behind a seemingly simple analysis feature, increasing the chance of undisclosed data collection and user tracking.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The documentation extends the skill from local behavior analysis into cloud-based historical report querying and report-link retrieval, which materially broadens the data exposure surface. In a mental-health context, historical report access can reveal longitudinal behavioral profiles and sensitive personal information beyond what users may expect from the manifest.

Description-Behavior Mismatch

Low
Confidence
84% confidence
Finding
The skill says uploaded media will be automatically saved as local files, but this storage behavior is not disclosed in the manifest description. Undisclosed local persistence is risky because uploaded home or office videos may contain highly sensitive footage, and silent saving increases the chance of retention, leakage, or later misuse.

Intent-Code Divergence

Low
Confidence
74% confidence
Finding
The documentation forbids using local memory for report retrieval while simultaneously describing reuse or creation of a default local user profile for association. That contradiction is dangerous because it obscures whether persistent identifiers are being stored locally, making privacy guarantees unreliable and enabling unintended cross-session tracking.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script exposes a hidden per-user history/listing capability via `--list` and an undisclosed `open_id` flow that is not part of the stated video-analysis behavior. In a mental-health monitoring context, this can reveal sensitive historical anxiety-behavior results for a user, creating a privacy risk and a potential unauthorized data-access path if identity resolution is weak or implicit.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code silently initializes an internal user identity using `OpenIdUtil.resolve_current_open_id(...)` even though the tool presents itself as a local/fixed-camera behavior analysis utility. Because the skill processes highly sensitive mental-health-adjacent observations, introducing hidden identity linkage increases the risk of covert tracking, cross-session correlation, and access to user-specific records without clear consent or necessity.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill exposes report-listing and export URL functionality that goes beyond the manifest’s stated behavior of analyzing a provided video and sending alerts. In a health/behavior monitoring context, report history and export links can reveal sensitive behavioral inferences and increase the chance of unauthorized access or data over-collection if not tightly scoped and access-controlled.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The code accepts arbitrary HTTP(S) video URLs and forwards them for analysis, which is broader than the described fixed-camera home/office use case. This can enable unintended monitoring targets, ingestion of third-party content, and possible misuse of the backend as a fetch/proxy mechanism for remote resources outside the user’s own environment.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill is described as anxiety-behavior video analysis, yet this file implements a generic user-account DAO with broad CRUD support. That capability expansion increases the data-handling and abuse surface beyond the declared purpose, especially in a home/office monitoring context involving potentially sensitive subjects.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The model stores authentication-like tokens, open tokens, email, real name, birthday, sex, and age, none of which are clearly necessary for detecting hand rubbing, nail biting, or pacing. In a fixed-camera monitoring skill, collecting and persisting excess identity and token data creates unnecessary privacy and credential exposure risk if the local database is accessed or mishandled.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This code creates or resolves persistent user identities, reads an identity from a workspace credential file, and stores default identities locally. Those capabilities materially exceed the stated purpose of anxiety-behavior video analysis and introduce hidden account linkage and credential-handling behavior that can track users or bind skill activity to remote services without clear user consent.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The HTTP helper performs external API access, silent login/registration, token acquisition/refresh, and local credential caching, all of which are broader than the manifest's narrow behavior-recognition function. In a fixed-camera monitoring skill handling sensitive personal behavior data, undisclosed networked identity and token management significantly raises privacy, account abuse, and data exfiltration risk.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code enumerates agent workspace layout, inspects OPENCLAW_WORKSPACE, and creates data/skills directories, giving the skill awareness of broader agent filesystem structure beyond its stated purpose. For a narrowly scoped anxiety-detection skill, this increases the attack surface for cross-workspace persistence, unexpected data access, and environmental reconnaissance.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger logic is broad enough to activate on common terms related to anxiety, nervousness, restlessness, relaxation, or counseling, potentially invoking surveillance-style video analysis when the user did not clearly request it. In a mental-health and camera-analysis setting, unintended activation is especially risky because it can process highly sensitive media and produce stigmatizing inferences without explicit informed intent.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill describes continuous fixed-camera monitoring, cloud report queries, and local saving of uploaded media without presenting a clear upfront warning about privacy, retention, and data flows at the point where the behavior is introduced. Because the content concerns home or office surveillance and mental-health inference, insufficient disclosure materially increases the risk of covert monitoring, non-consensual collection, and sensitive-data misuse.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill reads the entire local file and submits it for analysis without any visible warning, consent prompt, or disclosure in this code path. Because the content is home/office behavioral video related to anxiety indicators, the data is highly sensitive and silent transmission can expose intimate health-related observations and personal environment details.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The request flow transmits identifiers and authentication material such as username/open-id, tokens, and app identifiers during ordinary operation without any visible user-facing disclosure in this code path. Because the skill concerns sensitive home/office behavioral monitoring, silent identity transmission is especially problematic from a privacy and trust perspective.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code silently reads data/smyx-api-key.txt to derive an identity value, which creates implicit credential or identity use without user awareness. This can cause unintended account association and hidden reuse of workspace-level secrets across skills or agents.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2