Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its diet-video analysis purpose, but it silently creates or reuses cloud-linked identities and stores authentication tokens for health-adjacent media workflows.
Review before installing if you are uncomfortable with uploaded meal videos, cloud report history, automatic identity association, silent account creation, or local token storage. Use only with media you are willing to send to the provider's API, and avoid using it for sensitive medical or private household footage unless those data practices are acceptable to you.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
Hidden identity creation/resolution, token management, external HTTP communication, local persistence, and filesystem discovery exceed the apparent scope of a user-facing nutrition-analysis tool. Because the skill handles potentially sensitive health-related video and report history, undisclosed identity and token handling is especially dangerous and can expose users to privacy and account risks.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "diet-analysis"
description: "Analyzes videos to evaluate human eating behaviors, habits, and dietary patterns. It identifies tendencies towards unhealthy eating and provides structured analysis reports along with nutritional improvement recommendations. | 饮食行为健康分析工具，针对人的饮食行为、进食习惯、饮食结构进行视频分析，识别不良饮食行为倾向，提供结构化分析报告和营养改善建议"
version: "1.0.20"
license: "MIT-0"
---
# 🍽️ Dietary Behavior Health Analyzer | 饮食行为健康分析工具
> **智能分析中枢** · 图片/视频智能分�
This utility file contains broad identity resolution, local account persistence, token handling, remote login/registration, and authenticated HTTP capabilities that are unrelated to diet video analysis. In the context of a narrowly scoped diet-analysis skill, this creates hidden privilege expansion and data-flow risk because the skill can derive identities, provision accounts, and send authenticated requests without clear necessity or user awareness.
The code can silently register or log in a user on a remote health service using locally derived identifiers, including setting register=1 and silent=1. For a diet-analysis skill, that is unjustified and dangerous because it can create remote accounts and transmit identity data without informed consent, enabling unauthorized linkage of local users to external services.
The skill advertises and instructs use of shell execution, network access, local file handling, and likely environment/config usage, but does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege enforcement and makes it easier for the skill to invoke more capability than users or the platform may expect.
The default trigger boundary is vague, so the skill may auto-activate on loosely related inputs or any uploaded media mentioning diet or health. Unintended activation is risky here because it can cause unnecessary file handling, cloud upload, or analysis of sensitive personal videos.
The history-report trigger keywords are broad enough that ordinary conversation about reports could unintentionally invoke cloud-side report retrieval. In this health-related context, accidental retrieval or display of historical diet reports can expose sensitive personal information without clear user intent.
The description does not prominently warn users that uploaded media and identity-linked report queries are sent to a cloud API. For a health-adjacent skill processing videos of people eating, that omission undermines informed consent and can lead to privacy surprises even if transport security is later mentioned elsewhere.
The skill advertises video-based diet analysis, but it also exposes a history-listing function that can enumerate prior analysis records by OpenID. That creates an access-scope expansion beyond the declared purpose and can leak sensitive behavioral or health-related metadata if authorization checks are weak or if the caller can influence which identity is queried.
The code resolves and uses an internal user identity for a diet-analysis workflow without a clear need from the stated functionality. Because the skill processes potentially sensitive health-adjacent data, hidden identity binding increases the risk of cross-user data access, unauthorized history retrieval, or silent association of results with an internal account context.
The skill performs internal identity resolution without a user-facing warning or disclosure, which is problematic in a tool handling diet and behavior analysis data. Silent identity resolution can mislead users about whose data is being accessed or associated, and it reduces transparency around privacy-sensitive processing.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Multiple returned messages are hard-coded in Chinese, including report headers, status messages, and error text. This imposes a specific language/locale on users with no visible option to select another language or explicitly opt in.
The code reads an entire local file into memory and uploads it to a remote analysis service, or forwards a remote video URL for external processing, without any user-facing notice, consent step, or disclosure in this execution path. Because the skill processes highly sensitive behavioral/health-related video data, silent transmission to an external service creates a meaningful privacy and compliance risk even if the upload is functionally intended.
This file exposes generic HTTP CRUD helpers that can send arbitrary GET/POST/PUT/DELETE requests to caller-supplied URLs, which is broader than a diet-analysis skill needs. In an agent-skill context, such broad network primitives can be repurposed to interact with unintended internal or external services, increasing the risk of capability overreach, SSRF-style access, or unauthorized remote actions if higher-level controls are weak.
The code provides general remote resource management operations such as add, edit, and delete, which exceed the manifest's stated purpose of analyzing eating behavior and generating reports. Even if intended as shared infrastructure, embedding write-capable remote management functions in this skill expands the attack surface and may enable unauthorized state changes against backend services.
Detected: suspicious.install_untrusted_source