Security audit

Dietary Behavior Health Analyzer | 饮食行为健康分析工具

Security checks across malware telemetry and agentic risk

Overview

This diet-video analysis skill is mostly purpose-aligned, but it needs Review because it uploads sensitive media, automatically manages identity, and stores local auth/user data while its privacy and transport disclosures do not fully match the implementation.

Install only if you are comfortable sending meal videos or video URLs to the LifeEmergence/SMYX backend and allowing the skill to create or reuse a local identity record. Before use, verify the package is configured for production HTTPS endpoints, understand how to delete the local workspace data/SQLite records, and avoid triggering history lookup unless you intend to retrieve prior diet-analysis reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)
Confidence: 80% confidence
Finding: Using getattr(self.__model__, key) with caller-supplied filter keys can expose unintended model attributes or trigger exceptions, enabling denial-of-service and potentially bypassing intended query restrictions. While SQLAlchemy prevents classic SQL injection here, the lack of field validation creates an unsafe query surface and can support unauthorized enumeration of sensitive columns.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) return query.scalar() finally:
Confidence: 80% confidence
Finding: The count() method has the same unsafe dynamic attribute pattern as list(), accepting unvalidated filter keys that can cause errors or permit querying over unintended fields. This broadens the attack surface for metadata discovery and denial-of-service through malformed inputs.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs execution of local Python scripts, handling local files, network URLs, shell commands, and cloud API access, but declares no explicit permissions or capability boundaries. This creates a governance gap: an agent may be induced to use filesystem, network, and shell access without a transparent permission contract or least-privilege controls.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The workflow says uploaded media should be automatically saved as local files, while the privacy section claims original videos are deleted immediately and not retained. That inconsistency can mislead users and operators about where sensitive health-related media resides, increasing the risk of unintended retention, local exposure, or noncompliant handling of personal data.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The skill says no internal identity values should be exposed, yet it also states a local default user will be created and reused when no upstream identity is provided. Even if not directly exposed to the user, persistent local identity linkage contradicts the claim of minimal stored identifying data and can enable unintended cross-session correlation.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill exposes a per-user analysis history listing function (`show_analyze_list`) that is not necessary for the stated purpose of analyzing a provided video and returning recommendations. Features that enumerate prior user activity increase data exposure risk, especially if OpenID handling or authorization checks are weak elsewhere, because they can reveal sensitive behavioral/health-related history.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script resolves and uses an internal user identity (`OpenIdUtil.resolve_current_open_id`) even though the advertised functionality is just video diet analysis. Introducing hidden identity resolution expands the trust boundary and can silently bind analysis requests and history access to a user account, creating privacy and authorization risks that are not apparent from the manifest.

Description-Behavior Mismatch

Medium

Confidence: 77% confidence
Finding: The skill constructs and returns report export URLs and also exposes report-listing behavior beyond the stated manifest description of analyzing eating behavior videos. If these report IDs or listings are accessible without strong authorization, the feature can expose prior analysis artifacts or sensitive health-related outputs to users who should not see them.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script exposes a history-listing function that retrieves prior analysis results via `skill.get_output_analysis_list(open_id=open_id)`, which is broader than the stated purpose of analyzing a provided video. In a diet-analysis context, prior reports may contain sensitive behavioral or health-related inferences, so exposing listing functionality increases the risk of unauthorized access or privacy leakage if identity handling is weak elsewhere.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill resolves and uses a hidden `--open-id` parameter and a global current-open-id mechanism to access user-scoped analysis history, despite that capability not being justified by the advertised diet-analysis function. Hidden identity parameters are especially risky because they create a non-obvious access path to potentially sensitive user data, including health-adjacent behavior analysis, and can enable insecure direct object reference or cross-user data exposure if not tightly controlled.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This file exposes a broad generic network/CRUD wrapper layer that is not narrowly scoped to diet-video analysis. In a skill whose declared purpose is analyzing eating behavior, such reusable request primitives materially expand capability for arbitrary remote interaction, data modification, and service access, increasing the risk of misuse, hidden data exfiltration paths, or unauthorized backend operations if other parts of the skill can invoke them.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The get_user_by_username capability enables user-account lookup that is not justified by the stated video diet-analysis function. Unnecessary identity lookup features increase privacy and enumeration risk, and could be abused to discover valid accounts or correlate user identities with analyzed content if exposed through the skill.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: This file defines generic user-account persistence for usernames, real names, email, birthday, tokens, and account lookup behavior, which is materially outside a diet-video analysis skill's declared scope. Capability drift like this increases the chance of covert identity tracking, unnecessary data retention, and cross-feature abuse if the skill is granted access in a context that expects analytics only.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The User model stores authentication/profile-related data including token, open_token, email, birthday, and identity fields without clear relevance to dietary video analysis. Collecting and persisting such sensitive data unnecessarily raises privacy and account-compromise risk, especially if stored locally in SQLite without demonstrated encryption, access controls, or retention limits.

Description-Behavior Mismatch

Medium

Confidence: 78% confidence
Finding: The DAO automatically creates and modifies a local SQLite database, introducing persistent state and schema mutation in a skill described as an analysis tool. In context, this increases privacy and transparency risk because user data may be retained locally without an obvious need or user expectation.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This utility layer performs authenticated outbound API access, token management, and implicit account provisioning that are unrelated to the advertised diet-video analysis behavior. That creates a hidden capability for external data transmission and remote account interaction, increasing the chance that user data, workspace context, or derived identifiers are sent off-platform without informed consent.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code auto-resolves, creates, persists, and reuses default user identities, including reading from local files and a database, even when the caller did not explicitly provide an identity. For a diet-analysis skill, this is unrelated hidden identity management behavior and can silently associate user activity with generated or recovered accounts.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The code enumerates workspace and agent-environment paths, detects pack structure, and locates data and skills directories. While this may be intended for portability, it gives the skill broader environmental awareness than its diet-analysis purpose requires and can facilitate access to unrelated local files and agent-scoped resources.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The auto-trigger keywords for historical report lookup are broad enough to match ordinary conversation, which may cause the agent to query cloud-side personal health history without sufficiently explicit user intent. In a health-analysis context, accidental retrieval of prior reports is privacy-sensitive and could expose past dietary assessments or associated report links.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The default activation rule says the skill should trigger when a user provides a video URL or file needing diet analysis, but the wording is broad and may over-activate on loosely related content. Because the skill performs file handling and remote API processing of potentially sensitive health media, ambiguous invocation increases the chance of unintended data processing or upload.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill reads arbitrary local file contents and sends them to the analysis backend without any user-visible consent, warning, or confirmation in this code path. Because the skill handles videos of human eating behavior, the transmitted data may contain sensitive biometric, behavioral, or health-adjacent information, increasing privacy risk if users do not clearly understand that local content is being uploaded.

Missing User Warnings

Low

Confidence: 70% confidence
Finding: The save routine blindly opens the supplied path for writing and suppresses all exceptions, which can overwrite arbitrary files if an attacker can influence the path or if the caller passes an unsafe location. Silent failure also hides partial writes, permission issues, or tampering attempts, making detection and recovery harder.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When debug mode is enabled, HTTPConnection and urllib3 debug logging are turned on globally. This can expose request URLs, headers, bodies, and responses in logs, potentially leaking tokens, identity values, or sensitive analysis data without a user-facing warning.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The function reads an identity-like value from data/smyx-api-key.txt and uses it as an internal open-id source. This is sensitive workspace data access that is not obviously related to diet analysis and can silently bind requests to a stored credential or identifier.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The request helper automatically injects usernames, tenant data, skill metadata, tokens, and authorization headers into outbound HTTP requests. In the context of a diet-analysis skill, this silent transmission materially increases privacy and security risk because user-linked identifiers and credentials may be sent without clear disclosure or strict necessity.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2