Back to skill

Security audit

Micro-Expression Recognition & Analysis Tool | 微观情绪识别分析工具

Security checks across malware telemetry and agentic risk

Overview

This skill performs the advertised cloud emotion-analysis workflow, but it also silently binds use to local identity records and remote account/token flows for sensitive face media.

Review this skill before installing. Use it only if you are comfortable sending face videos or URLs to the vendor's cloud service and having reports tied to an automatically managed local/remote identity. Avoid using it for employment, legal, medical, school discipline, surveillance, or other high-stakes decisions, and do not treat its emotion outputs as objective proof of a person's true feelings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (36)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
81% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
79% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises no explicit permissions while instructing use of shell execution, local file handling, network access, environment/internal identity use, and local persistence. This mismatch is dangerous because it prevents informed consent and weakens policy enforcement around media uploads, report retrieval, and local state/token storage.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The manifest claims a narrowly scoped micro-expression analysis tool, but the described behavior expands into cloud report listing, report-link generation, local identity creation/reuse, token persistence, and generic remote AI invocation. That mismatch is security-relevant because users may provide sensitive media expecting a bounded function, while the skill actually enables broader data processing and persistence than disclosed.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill includes hidden identity resolution and a list mode that retrieves a user's analysis history, which is unrelated to the core function of analyzing a provided video. Because the open-id parameter is suppressed from help output and the code resolves internal identity implicitly, users may be unaware that identity-linked records can be accessed or enumerated.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The comment states that user identity does not need to be provided or exposed, yet the parser still accepts a hidden --open-id argument and passes it into identity resolution. This mismatch reduces transparency and can conceal identity-sensitive behavior from reviewers and users, increasing the risk of misuse or unauthorized access paths.

Description-Behavior Mismatch

High
Confidence
90% confidence
Finding
The implementation does not visibly perform facial micro-expression recognition itself; instead it forwards an input path or URL to a generic backend method and also exposes broader analysis behavior. This mismatch between the advertised purpose and the actual behavior is dangerous because users may provide sensitive biometric video under the assumption of narrowly scoped emotion analysis, while the backend capability appears broader and less transparent.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The history-list feature allows enumeration of prior analyses, which is unrelated to the stated single-purpose emotion-analysis workflow. In a biometric/video-analysis context, exposing historical job metadata or outputs can leak sensitive user activity, prior submissions, or analysis results beyond the user’s immediate request.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file implements a generic network API wrapper with pagination, CRUD-style methods, arbitrary URL dispatch, and helper calls that materially exceed the declared purpose of an emotion-analysis skill. In a skill ecosystem, this kind of broad remote-call capability can be repurposed for unauthorized data access, exfiltration, or destructive actions against backend services, especially because the methods accept caller-supplied URLs and payloads with minimal restriction.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The get_user_by_username helper provides user enumeration or identity lookup functionality unrelated to facial micro-expression analysis. In this skill context, that mismatch increases concern because it enables access to user/account information that is not needed for the advertised function, broadening the attack surface and creating privacy risk.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file defines persistent storage for user identities, profile fields, and timestamps even though the declared skill is emotion analysis. This creates unjustified collection and retention of personal data, increasing privacy and compliance risk if the skill stores facial-analysis users or linked identities without clear necessity or consent.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The model includes account/profile identifiers plus token and open_token storage, which is disproportionate to an emotion-analysis capability. Persisting authentication-like tokens alongside personal attributes materially increases the blast radius of compromise and suggests the skill may act beyond its stated purpose.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file for an emotion-analysis skill instead exposes a generic AI chat/agent interface, which is inconsistent with the declared purpose and expands the skill's effective capability beyond what a user or reviewer would expect. In security-sensitive plugin ecosystems, this kind of scope mismatch is dangerous because it can conceal unintended prompt forwarding, agent execution pathways, or future command-execution hooks under an unrelated manifest.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The docstring states that the method invokes an external agent via subprocess, but the implementation does not do so. This misleading behavior is a security problem because reviewers, users, or calling code may make trust decisions based on false assumptions about what runs locally versus what is stubbed, which can hide later-introduced execution behavior or frustrate auditing.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
The file contains broad agent workspace discovery, directory creation, identity resolution, API-key file reads, and local user record management that are unrelated to the declared emotion-analysis purpose. This scope mismatch is dangerous because it expands the skill's authority over the host workspace and identities, creating unnecessary access to files and persistent state that a user would not expect from an emotion-analysis tool.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The HTTP helper performs hidden account lookup, automatic login/registration, token persistence, and even payment-upgrade prompting, which are materially outside the advertised scope of facial emotion analysis. In a skill context, this is dangerous because invoking ordinary analysis features may silently trigger authenticated network actions and account lifecycle changes without informed user approval.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill reads workspace data files, creates directories, queries local user records, and writes persistent default identities despite no clear need for these actions in an emotion-analysis tool. This increases risk because it grants the skill durable access to local workspace state and identity material, enabling tracking, persistence, or later misuse beyond the user's expected task.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The automatic history-report triggers are broad enough to activate on ordinary conversational phrases, which can cause unintended cloud queries and disclosure of past analysis records. In a privacy-sensitive skill handling emotional inferences and media, accidental retrieval of historical reports materially increases exposure risk.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill processes uploaded images/videos and queries cloud services, yet the description does not clearly warn users that biometric/emotion-related media may be transmitted remotely and linked to stored history. This is dangerous because users may unknowingly submit highly sensitive personal data without understanding retention, sharing, or account linkage implications.

Natural-Language Policy Violations

High
Confidence
96% confidence
Finding
The skill claims it can objectively reveal a person's true inner emotions and penetrate disguises, which is an unsupported and high-risk assertion for an emotion-inference system. Such claims can mislead users into overtrusting outputs, enabling harmful decisions, profiling, or surveillance based on unreliable inferred mental-state judgments.

Natural-Language Policy Violations

High
Confidence
96% confidence
Finding
The Chinese description repeats the claim that the tool can objectively expose a person's most real inner emotional fluctuations, creating the same overclaim and overreliance risk for Chinese-speaking users. Because the content targets sensitive psychological inference, misleading certainty amplifies potential privacy, discrimination, and misuse harms.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The call to resolve_current_open_id accesses or derives internal user identity without clear user-facing disclosure. In a skill whose stated purpose is emotion analysis, silently binding actions to an internal identity can create privacy and authorization risks, especially when combined with history-listing functionality.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The analysis function sends the provided local file path or URL into skill.get_output_analysis, which likely forwards video data to an external service, but the CLI does not clearly warn users about that transfer. Since video used for facial micro-expression analysis is highly sensitive biometric/behavioral data, undisclosed transmission materially increases privacy risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The function reads arbitrary local file contents from a user-supplied path and uploads them to an external analysis service, but this file provides no explicit consent prompt, destination disclosure, or warning that local media will leave the device. In a privacy-sensitive skill that analyzes facial expressions and inferred emotional state, silent upload increases the risk of unintended disclosure of sensitive biometric and personal data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The tool sends user-supplied local file paths or remote video URLs to an external analysis service via skill.get_output_analysis without any explicit warning, consent flow, or data-handling disclosure. Because the skill is marketed for micro-expression analysis of faces, the transmitted content is likely highly sensitive biometric video, making silent network transfer particularly risky in this context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2