Driver Facial Flushing / Sweat Abnormality Detection | 驾驶员面部潮红/出汗异常检测

• Outcome: Review
• Latest audit: Aug 25, 2026 · 4:35 PM UTC
• Version: 1.0.9

Overview

This skill is a driver health video analyzer, but it also automatically creates or reuses identity records, stores tokens locally, and sends sensitive facial-health media and identifiers to remote services with limited user control.

Review before installing. Use only with explicit driver or employee consent, confirm which backend environment will receive the video and identifiers, avoid arbitrary remote URLs, and require a clear way to disable or delete local identity/token storage and cloud history access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions while its documented behavior clearly involves shell execution, network access, local file handling, and likely environment usage. This mismatch is dangerous because it hides the real attack surface from users and policy enforcement, making unintended data access or outbound transmission easier to miss.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill presents itself as a narrowly scoped driver-health video analyzer, but the described behavior includes backend identity creation, login/token handling, local SQLite persistence, cloud report retrieval, and arbitrary file/URL processing. This is dangerous because users may authorize sensitive biometric workflows without understanding that identity-linked data is being persisted and transmitted to remote services beyond the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The driver-monitoring skill exposes an unrelated `pet_type` parameter and mutates a global default (`ConstantEnum.DEFAULT__PET_TYPE`) based on user input, which indicates unsafe code reuse across domains. In a safety-sensitive health-monitoring context, this can misroute requests, alter downstream model selection or business logic, and produce incorrect health-risk assessments, especially if the shared constant affects other invocations or components.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill accepts arbitrary http/https video URLs and forwards them for backend analysis, even though the skill description implies use of an in-cabin DMS camera feed. This broadens the trust boundary, enabling analysis of attacker-controlled remote content and potentially causing unintended outbound fetches, privacy issues, or policy bypass if the backend retrieves those URLs.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script exposes a `--list` path that retrieves prior analysis history via `skill.get_output_analysis_list(open_id=open_id)`, which goes beyond the manifest’s stated purpose of real-time driver health-risk analysis. In a health-related video context, retaining and exposing historical analysis results can disclose sensitive biometric/medical inferences if access control, user consent, or purpose limitation are weak.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code imports and uses an `open_id` identity context and later resolves the current identity before allowing history access, introducing user-linked data access in a skill described as simple video analysis. Because the analyzed content concerns possible health conditions from facial video, tying results to an identity increases privacy sensitivity and raises the risk of unauthorized access to personal health-related records.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file exposes a generic API wrapper that can issue arbitrary GET/POST/PUT/DELETE requests and perform CRUD-style operations unrelated to the declared purpose of in-cabin driver health analysis. In a skill whose manifest describes local video-based detection and risk reminders, this broad remote access surface enables unexpected data exfiltration, remote state changes, or integration with unscoped backend services, making the implementation materially more dangerous than the stated functionality suggests.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The add, edit, delete, and arbitrary HTTP helper methods permit remote record creation, modification, deletion, and unrestricted URL access, none of which are justified by an analysis-only driver monitoring skill. If abused by surrounding code or configuration, these methods could be used to alter backend data, trigger unauthorized operations, or send sensitive driver-related data to unintended destinations.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file includes a generic User/UserDao with account-like persistence that is unrelated to the declared driver flushing/sweat detection purpose. In a health-monitoring skill, collecting and persisting user identity records broadens data exposure and creates unjustified retention of personal data, increasing privacy and unauthorized-access risk.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The code initializes a shared local SQLite database and provides broad CRUD capability that is not described in the skill manifest for real-time in-cabin health alerting. Hidden persistence expands the attack surface and can enable silent storage of sensitive behavioral or user data beyond user expectations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The User model stores identity and authentication-adjacent fields such as username, realname, email, token, and open_token, none of which are justified by a driver sweat/flushing detection skill. In this context, such data collection is especially sensitive because it combines health-related inference with persistent identifiers and tokens, creating elevated privacy and account-compromise risk.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file for a driver health-monitoring skill exposes a generic `ai_chat` capability that is unrelated to the declared flushing/sweat detection purpose. Even though the subprocess call is currently commented out, the presence of a reusable prompt-passing agent interface expands the skill's effective scope and creates a pathway for future arbitrary LLM or command execution behavior that is not justified by the business function.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility file contains broad account provisioning, token management, and authenticated remote API request logic that is unrelated to the declared driver-face video health analysis purpose. That mismatch expands the skill's privilege and data-exfiltration surface, making it capable of interacting with remote backend services and moving identity data off-device without necessity for the stated function.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code automatically logs in or creates users against a health backend via /sys/phoneLogin using locally resolved identifiers, even when the skill's stated purpose is only local in-cabin physiological cue analysis. Auto-provisioning accounts without an explicit user action can silently enroll users in a backend system, create persistent identifiers, and link local activity to remote services.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The utility resolves backend identity by reading workspace files, environment-derived paths, and local database records, then persists or reuses that identity for future operations. For a narrowly scoped sensing skill, this is unjustified identity harvesting/persistence behavior that increases privacy risk and creates a hidden trust relationship with backend services.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default trigger condition activates the skill broadly whenever a user provides a driver-face video URL or file for analysis, without narrow confirmation of intent or scope. Overly broad auto-invocation can cause accidental processing of sensitive biometric media and unexpected network/API calls, especially in environments where files are attached for general discussion rather than explicit execution.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The history-report feature is configured to auto-trigger on broad phrases like viewing reports or event lists, which can initiate cloud queries for potentially sensitive driver health records without strong scope checks. In a biometric and health-monitoring context, accidental disclosure or retrieval of historical reports creates significant privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The code transmits either full file contents or a remote video URL to an analysis service without any user-visible notice, consent check, or data handling warning in this flow. Because the media is facial/health-related driver footage, the privacy sensitivity is high and silent transmission increases the risk of unauthorized disclosure or noncompliant processing.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The tool accepts local file paths or URLs and forwards them to backend analysis (`skill.get_output_analysis`) without any explicit warning that sensitive in-cabin facial video may be transmitted to a remote service. In this skill context, the data may reveal biometric traits and health-condition inferences, so silent remote transmission meaningfully increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The download-URL helper performs a network POST but this file contains no indication of user disclosure, consent gating, or transparency around data leaving the local environment. In a vehicle health-monitoring context involving potentially sensitive biometric or health-adjacent information, undisclosed network transmission increases privacy and compliance risk even if the method itself appears routine.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The delete helper sends a remote deletion request without any visible warning, approval check, or indication of what resource may be removed. In a skill whose declared purpose is passive health analysis rather than remote administration, silent deletion capability is unexpected and can enable destructive actions against backend records or evidence without user awareness.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The request wrapper injects usernames, tokens, tenant metadata, and platform identifiers into outbound requests without any user-facing disclosure in normal operation. In the context of a health-related driver monitoring skill, silent transmission of identity-linked data is especially sensitive because it can associate health-risk inferences with a persistent backend account.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code reads an internal identity value from data/smyx-api-key.txt and later reuses or persists identity information locally without warning the user. This creates undisclosed local storage and reuse of identity material, which is inappropriate for a skill whose declared purpose is sensor-based driver health alerting rather than account management.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 97% confidence
• Finding: This outbound requests.post() sends openId/mobile/source fields to a remote health backend as part of automatic login or registration. External transmission is expected for networked features, but here it is dangerous because the skill's stated purpose does not justify sending user identifiers off-device, and the transmission is tied to hidden account provisioning behavior.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: "smyx-driver-flushing-sweat-detection-analysis"
description: "Using an in-cabin DMS camera, the system analyzes the driver's facial video in real time, detecting skin color variation (flush index, derived from red-channel ratio in RGB or skin-color models) and sweat-droplet / reflective area (via image texture and reflection features). | 通过车载DMS摄像头实时分析驾驶员面部视频，检测面部肤色变化（潮红指数，通过RGB色空间中的红色分量比例或肤色模型）以及汗珠/反光面积（通过图像纹理和反射特征）。当潮红指数显著升高（可能提示血压升高、发热或情绪激动）或出汗区域面积超过阈值（可能提示热应激、低血糖或心脏问题）时，输出健康风险提醒，建议驾驶员停车休息或就医。"
version: "1.0.11"
license: "MIT-0"
---

• Confidence: 78% confidence
• Finding: The metadata is flagged for tool/manifest poisoning indicators, and in context the skill manifest mixes persuasive operational instructions with hidden-instruction concerns elsewhere in the file. Even if not overtly malicious, poisoned or misleading metadata can manipulate orchestration behavior, bypass normal scrutiny, or cause unsafe automatic execution paths.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2