Micro-Expression Recognition & Analysis Tool | 微观情绪识别分析工具

• Outcome: Review
• Latest audit: Oct 2, 2026 · 3:54 PM UTC
• Version: 1.0.17

Overview

This facial emotion-analysis skill needs Review because it uploads sensitive media to a remote service while silently creating and reusing persistent account identifiers and tokens.

Install only if you are comfortable sending facial videos or URLs to lifeemergence.com/open.lifeemergence.com services and having a local workspace database retain account identifiers and tokens. Use it only with consent from people in the media, and avoid installing it in workspaces where persistent identity or report-history access would be inappropriate.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (67)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding aggregates several real security concerns: local filesystem writes, environment/context detection, generated persistent identities, reading local identity/API data, outbound HTTP requests, and automatic external account registration/login. In a skill handling facial media and report history, these hidden behaviors significantly increase privacy, persistence, and exfiltration risk beyond user expectations.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "emotion-analysis"
description: "Professional discernment of subtle cues! It performs detailed analysis and recognition of facial micro-expressions, outputs precise emotional state reports, and unveils true inner emotional activities. | 微观情绪（微表情）识别分析工具，专业察言观色！针对人物面部微表情进行细致分析识别，输出精准的情绪状态分析报告，揭示真实内心情绪活动"
version: "1.0.16"
license: "MIT-0"
---

# 😊 Micro-Expression Recognition & Analysis Tool | 微观情绪识别分析工具
> **智能分析中枢** · 图片/视频智能分析 · 结

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill solicits facial images/videos and network URLs for remote analysis but lacks a clear privacy and consent warning about uploading biometric or highly sensitive personal data to external services. Because facial media and inferred emotional state are exceptionally sensitive, omission of this disclosure materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a tool for detailed facial micro-expression recognition and emotional-state reporting. In this file, the implemented behavior is simply passing a video path/URL to skill.get_output_analysis(...) and listing prior analyses via skill.get_output_analysis_list(...), while the CLI and function names describe only generic 'video analysis' without any face-, micro-expression-, or emotion-specific logic or constraints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements a generic network CRUD wrapper with download, list, add, edit, delete, and arbitrary HTTP methods, which does not align with a skill advertised as facial micro-expression and emotion analysis. In a skill context, this mismatch is dangerous because it gives the skill broad remote communication and resource-management capability that could be used to exfiltrate data, fetch unauthorized content, or interact with unrelated backend services under the guise of emotion analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The add, edit, delete, http_post, http_put, http_get, and http_delete methods expose arbitrary remote resource modification and retrieval through caller-supplied URLs. For an emotion-analysis skill, such broad mutation capability is unjustified and increases the risk that the skill could alter external systems, delete data, or act as a proxy for unauthorized network operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file implements persistent local storage and mutation of user records, including profile and token-like data, which is not justified by the declared emotion-analysis purpose. In the context of this skill, hidden user-data persistence increases privacy risk and creates a broader attack surface for cross-session tracking or unrelated data collection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The User model stores authentication-like tokens, open_token, email, birthday, and real identity attributes without any clear need for facial emotion analysis. Collecting and persisting such data in a skill with a different stated purpose is especially sensitive because it enables identity linkage, account misuse, and privacy-invasive profiling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file provides broad workspace discovery, file creation, account management, token handling, persistence, and external API communication that are not justified by the advertised facial micro-expression analysis purpose. In a skill context, this kind of overbroad capability materially increases the attack surface and enables covert collection, persistence, and remote interaction beyond user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This section resolves identities from environment, local files, and a local database, and can create default user identities automatically. For an emotion-analysis skill, silent identity selection and persistence is unjustified and dangerous because it enables tracking, account linkage, and later authenticated actions without informed user approval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The HTTP helper can automatically register or log in a user with an external service, retrieve tokens, cache them locally, and attach them to future requests. That behavior exceeds what is needed for emotion recognition and creates a covert authentication channel that can transmit identity and establish persistent external accounts without the user's knowledge.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code prepares and sends network requests containing user identity fields and later authorization material, but the skill description does not justify transmitting such data to external services. The mismatch between stated purpose and actual behavior makes covert data exfiltration or unauthorized account activity significantly more dangerous.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and instructs use of shell execution, local file handling, network access, and identity/config persistence, but declares no explicit tool scope or permission boundaries. That creates an over-privileged integration surface where a host agent may grant broader capabilities than necessary, increasing the chance of data exfiltration, unintended file access, or command execution abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Lines L026-L031 repeatedly state that the system can 'objectively reveal' an individual's 'true inner emotional fluctuations' and 'most真实的内心情感波动'. This language presents inferred emotional state as definitive fact rather than uncertain analysis, creating a policy-relevant natural-language concern around overclaiming behavioral inference capability.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2