Elderly Facial Asymmetry / Mouth-Corner Deviation Detection | 老年人面部不对称/口角歪斜识别

• Outcome: Review
• Latest audit: Aug 25, 2026 · 8:23 AM UTC
• Version: 1.0.9

Overview

This health-camera skill is purpose-related, but it should go to Review because it links sensitive facial analysis to automatic identity, cloud history, local token storage, and under-disclosed remote account handling.

Review before installing. Use this only if the monitored person or guardian has consented to cloud-based facial/health screening, identity-linked report history, and local credential storage. Verify the API endpoints first, especially because the bundled config selects dev/private HTTP addresses, and require a clear plan for token storage, report deletion, and who can query historical reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and documents capabilities that include shell execution, network access, local file reads/writes, and environment access, yet no explicit permissions are declared. In a skill handling facial biometric and health-related data, this creates an opaque trust boundary where sensitive data can be transmitted, stored, or correlated without clear user or platform review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is facial asymmetry screening, but the observed behavior extends to identity handling, local user/open-id persistence, token acquisition, history retrieval, and generic remote submission. This mismatch is dangerous because users may consent to medical-image analysis without realizing the skill also performs account linkage, backend authentication, and long-term report tracking involving sensitive biometric and health data.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as analyzing images/video from a fixed home camera, but the implementation also accepts arbitrary HTTP/HTTPS video URLs. This expands the data-ingestion surface beyond the documented purpose and can enable unexpected external content retrieval, creating privacy, abuse, and policy-bypass risk if users or higher-level systems assume only local/home-camera media is processed.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file exposes report-history listing and report export-link generation in addition to the stated single-analysis function. In a health-related skill handling elderly facial imagery, undocumented access to prior reports and export URLs increases the chance of overbroad data exposure, especially if upstream authorization is weak or callers do not expect these capabilities to exist.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Remote URL ingestion is not clearly aligned with the declared fixed-home-camera screening purpose, making the capability suspicious from a least-privilege standpoint. In practice, this can be abused to analyze unrelated third-party videos or fetch content from untrusted sources, which is especially concerning in a medical-screening context involving sensitive biometric data.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The file exposes a historical analysis listing function through `--list`, which is outside the narrowly stated purpose of one-off facial asymmetry analysis and may reveal prior analysis records tied to an `open_id`. In a healthcare-adjacent context involving elderly facial images/videos, unauthorized or overly broad access to historical analysis metadata or results can create privacy and confidentiality risks even if the access control is implemented elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This file implements a generic remote API wrapper with CRUD-style methods and arbitrary HTTP verbs, which gives the skill a broad network client capability far beyond the stated facial asymmetry analysis purpose. In a health-screening skill that processes elderly users' images and metadata, this unnecessary capability increases the attack surface for unintended data exfiltration, backend abuse, or invocation of unrelated remote operations if other parts of the skill pass untrusted URLs or payloads.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The code exposes remote resource-management operations such as add, edit, delete, list, and generic POST/PUT/GET helpers, which materially exceed the manifest's claimed function of computing a facial asymmetry index. This mismatch is dangerous because it creates hidden operational capability inside a sensitive medical-adjacent skill, making misuse or compromise more consequential, especially where elderly users' health-related data may be handled.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill is described as facial asymmetry analysis, but this shared DAO persists user identities and authentication-like tokens (token, open_token, email, realname) unrelated to that stated purpose. In a health-related elderly-monitoring context, collecting and retaining extra identity/auth data increases privacy exposure and broadens the blast radius if the local database is accessed or reused by other components.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The file performs broad local database initialization and schema migration for shared user records, which materially exceeds the functionality implied by a facial-landmark screening skill. In a medical-adjacent context involving elderly users, undisclosed persistent storage creates elevated privacy and consent concerns because users may not expect account/profile data to be created and modified behind the scenes.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file introduces a generic AI chat/agent-invocation capability that is unrelated to the advertised facial asymmetry analysis purpose. Even though the subprocess call is currently commented out, this creates hidden attack surface and functionality drift, which is risky in a health-related skill because future activation could enable unreviewed prompt handling or external command execution paths.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring claims the method invokes an external agent via subprocess, but the implementation does not do so and instead uses a dummy result object path that would fail at runtime. This kind of misleading security-relevant documentation is dangerous because reviewers and integrators may assume an execution model, data flow, and controls that do not actually exist, undermining threat modeling and safe deployment.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs broad remote API access, token injection, account lookup/creation, retry logic, and local persistence that are unrelated to a home-camera facial asymmetry screening skill. In the context of a medical-adjacent local analysis tool, this materially expands the trust boundary and enables covert networked behavior using user-linked identities and stored credentials.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code resolves, reuses, and auto-creates default open-id identities, including reading identity material from workspace files and persisting user records locally. For a skill described as facial asymmetry analysis for elderly stroke screening, hidden identity lifecycle management is unjustified and dangerous because it can silently bind medical-related activity to accounts without informed consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code calls a remote /sys/phoneLogin endpoint with silent and register flags enabled, effectively allowing implicit registration/login tied to an identifier. In a skill whose stated function is local facial asymmetry screening, silently creating or logging into remote accounts is highly concerning and can expose users to unauthorized data linkage, tracking, and backend account misuse.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The auto-trigger phrases for history lookup include broad report-related language, which can cause unintended invocation of cloud history retrieval. In this context, accidental triggering is more dangerous because the retrieved data concerns an elderly person's facial biometrics and possible stroke-risk reports, creating unnecessary exposure of sensitive health information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill centers on facial-image and video analysis but does not prominently disclose that sensitive biometric data and report queries may be transmitted to and stored in cloud services. For an elderly-health screening workflow, incomplete disclosure undermines informed consent and increases privacy, compliance, and secondary-use risks.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script silently resolves an internal user identity via `OpenIdUtil.resolve_current_open_id(...)` without clear user disclosure, even though the skill processes sensitive elderly facial imagery and related health inferences. In this context, hidden identity binding can enable opaque tracking, unexpected account attribution, and privacy violations if analysis records are linked to a person without informed consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Accepting a user-supplied URL for elderly facial images/videos can cause sensitive biometric and health-related data to be fetched or transmitted over the network without a clear privacy warning. In this medical-adjacent context, undisclosed remote transfer materially increases the risk of data leakage, third-party exposure, and accidental processing of protected personal information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code transmits either a remote video URL or raw file contents to an analysis backend without any user-facing notice, consent flow, or privacy warning in this file. Because the skill processes elderly facial videos for stroke-related screening, the data is highly sensitive health/biometric information, so silent transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The code automatically creates a shared data directory and database file without any user-facing notice or confirmation. In a consumer health-monitoring scenario, silent persistence is risky because it can store sensitive or health-adjacent user information on disk without the user's awareness, undermining transparency and consent.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: Automatic ALTER TABLE migration modifies an existing local database schema silently at startup. While not an exploit primitive by itself, it changes persisted data structures without disclosure, which is especially problematic when the skill operates in a health-related elderly-care context and stores identity-related records that users may not realize are being maintained.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The debug log prints the full prompt content directly, which may expose sensitive user input, medical context, or operational instructions in logs. In this skill's elderly health-screening context, prompts could contain health-related or identifying information, increasing privacy and compliance risk if logs are retained or accessed by unauthorized parties.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code reads an identity value from data/smyx-api-key.txt and later uses such identity material as part of account resolution and outbound requests, without any visible disclosure to the user. In a healthcare-oriented monitoring context, undisclosed use of identifiers increases privacy risk and can lead to unexpected association of sensitive activity with a user account.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This request path automatically transmits usernames/open IDs and authentication tokens in headers and request bodies during network operations, yet the skill description does not justify or disclose such behavior. Because the skill handles elderly facial-analysis use cases, undisclosed transmission of identity-linked data is especially sensitive and can create privacy, compliance, and account-security risks.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2