Security audit

Elderly Facial Asymmetry / Mouth-Corner Deviation Detection | 老年人面部不对称/口角歪斜识别

Security checks for vulnerabilities and agentic risk

Overview

Review before installing: this skill processes elderly face media through a cloud service while silently creating or reusing a backend identity and storing tokens locally.

Install only if you are comfortable sending elderly face images or videos and report history to the configured lifeemergence.com services. Obtain consent from the person or caregiver, treat results as non-diagnostic screening, and review or clear the workspace data database if you do not want backend identity tokens retained between runs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (61)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding combines multiple concerning behaviors: remote API communication, local file operations, identity/open_id creation, local records for users and tokens, and token management, all under a narrowly framed medical-screening label. In context, this is particularly dangerous because the skill handles elderly facial imagery—biometric and health-adjacent data—so hidden identity linkage and tokenized backend access raise both privacy and unauthorized-access risks.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "smyx-elderly-facial-asymmetry-analysis" description: "Using a fixed home camera to capture frontal facial images or short videos of the elderly, the system uses AI facial-landmark detection to analyze features such as the height difference between left/right mouth corners, the symmetry of nasolabial folds (smile lines), and the asymmetry of eyebrow lifts, and computes a facial asymmetry index (0-100%). | 通过家庭固定摄像头拍摄老年人正面面部图像或视频，利用AI面部关键点检测技术分析左右嘴角的高度差、鼻唇沟（法令纹）的对称性、眉毛抬高的差异等特征，计算面部不对�

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatic creation and reuse of a default local identity is unjustified for the stated task and can silently bind sensitive reports to the wrong person or merge multiple users into one account context. For a skill processing elderly facial data and producing medical-risk-style reports, implicit identity reuse materially raises confidentiality and integrity risks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation does not perform any of the medical facial-asymmetry analysis promised by the skill description, yet presents itself as a stroke-related screening aid. In a medical context, this mismatch is dangerous because users may rely on nonexistent analysis, leading to false reassurance, delayed care, or inappropriate operational deployment of the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This code fabricates default open_id values, searches local storage for reusable synthetic identities, and persists them for later reuse. For a home-health screening skill, silently generating and reusing backend-linked identities without user awareness is unjustified and can lead to covert tracking, unauthorized account creation, and misattribution of uploaded or associated health-related activity.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The utility layer performs remote login/registration token bootstrap and local credential persistence that are unrelated to the declared purpose of facial asymmetry screening from a home camera. In this context, hidden account provisioning and outbound authentication materially expand data exposure and trust boundaries, making the skill capable of silently enrolling users with a backend service and storing access tokens locally.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The helper silently calls a remote /sys/phoneLogin endpoint with register=1 and silent=1, creating or logging into an account automatically without any user warning. For a facial asymmetry screening skill aimed at elderly care, covert enrollment with a remote service is especially problematic because it can link sensitive health-related use to a backend identity without informed consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares powerful capabilities implicitly through its documented behavior—shell execution, network access, local file read/write, and environment use—without an explicit permission or allowed-tools boundary. In an agent setting, this increases the chance of over-privileged execution, makes security review harder, and enables unintended access paths if the skill is auto-invoked or repurposed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default activation condition is overly broad, allowing the skill to trigger whenever an elderly face image or video is present, even without a clear request for asymmetry screening. In this context, that creates unnecessary processing of biometric data and increases the likelihood of unintended remote submission or storage of sensitive media.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation adds cloud-based historical report lookup beyond the core facial asymmetry analysis function, which broadens access from single-item analysis to accumulated sensitive history. In a health/biometric context, history features increase privacy impact and create additional authorization and enumeration risks if not tightly scoped.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Broad historical-report trigger phrases can cause the skill to activate for generic requests and retrieve sensitive report data without sufficiently precise intent. Because these reports are linked to biometric/health-adjacent monitoring, accidental activation can expose private historical information beyond what the user meant to access.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes a narrowly scoped elderly facial asymmetry analysis tool, yet the implementation accepts pet_type values cat, dog, and other and assigns them into ConstantEnum.DEFAULT__PET_TYPE. That indicates the script is repurposed from a pet-analysis context and its actual behavior/configuration model does not cleanly match the stated elderly-focused function.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The argument parser description and help strings are written only in Chinese, and the runtime status/error messages are also Chinese-only. This imposes a specific language on users without any opt-in, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The argument help says the category selector is for an elderly health-monitoring scenario but still exposes choices cat, dog, and other, which contradicts the stated purpose of analyzing elderly human faces. This is more than an omission: the inline documentation actively frames a pet-oriented control as if it were appropriate for human medical screening.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2