Employee Emotion Fluctuation HR Report | 员工入职/离职情绪波动预警（HR方向）

• Outcome: Review
• Latest audit: Aug 7, 2026 · 3:51 PM UTC
• Version: 1.0.5

Overview

This skill is a high-impact workplace emotion-surveillance tool with remote processing, report history access, and persistent identity/token handling that are not tightly scoped to user-controlled, consent-verified use.

Review before installing. Only use this in an environment with explicit employee notice and consent, legal/HR approval, strict access controls, audit logging, and clear retention/deletion rules. Do not install if you need local-only processing, no persistent identity, or enforcement that only approved enterprise camera sources are analyzed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while its documented workflow requires shell execution, network access, local file reads/writes, and likely environment access. In a skill that processes sensitive employee-monitoring data, undeclared capabilities prevent informed review and increase the chance of covert data handling or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose centers on anonymous, consent-based emotion monitoring, but the behavior includes persistent local user identity creation, token storage, external auth flows, cloud report listing, and export-link generation. This mismatch is dangerous because reviewers and operators may authorize a narrowly scoped HR analytics skill while it actually performs broader identity persistence and remote data operations on highly sensitive employee data.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The skill promises anonymous-only processing and no HR identity mapping, yet its workflow creates or reuses a local default user identity. In this context, even a pseudonymous persistent identifier can undermine anonymity claims, enable cross-session linkage, and create a path to correlate sensitive emotion-monitoring results over time.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation forbids using local history for report retrieval, but the workflow says a local default user will be reused or created for future tasks. That contradiction creates ambiguity about what state is retained locally and may enable unintended correlation, access persistence, or silent reuse of credentials in a system handling employee wellness surveillance data.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Automatic cloud history querying and report-link retrieval extend the skill beyond simple analysis into sensitive historical-data access. Because the subject matter is employee emotion and behavior surveillance, automatic access to historical reports materially increases privacy risk, especially if triggered without granular authorization and visibility.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code accepts arbitrary http/https video URLs and forwards them for analysis, even though the stated skill purpose is monitoring fixed enterprise cameras with consent and anonymization controls. In this HR/emotion-analysis context, allowing unrestricted remote sources can bypass provenance, consent, and policy boundaries, enabling analysis of unauthorized third-party footage or untrusted external content.

Context-Inappropriate Capability

Low

• Confidence: 76% confidence
• Finding: The skill exposes report listing and export-link generation capabilities beyond the narrow function of submitting a video for emotion-fluctuation analysis. In a sensitive HR surveillance setting, these features can broaden access to historical reports and images, increasing the chance of privacy leakage, unauthorized discovery of employee monitoring outputs, or misuse of sensitive behavioral data.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The implementation materially exceeds the manifest’s stated purpose. Instead of being constrained to fixed-camera enterprise monitoring with consent/anonymization controls, the CLI can analyze arbitrary local videos, arbitrary remote URLs, and enumerate prior analyses by open_id, which creates a capability mismatch that can enable covert or unauthorized surveillance use beyond the declared HR scenario.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Accepting arbitrary remote video URLs allows the tool to be repurposed to analyze videos from untrusted or unauthorized sources unrelated to the fixed-camera office-monitoring use case. In this skill context, that broadens surveillance capability and can facilitate privacy violations, processing of non-consensual footage, and misuse against third parties.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This service exposes generic outbound HTTP methods (`http_post`, `http_put`, `http_get`, `http_delete`) that can be pointed at arbitrary URLs, which exceeds the stated HR emotion-monitoring purpose. In an agent/skill context, such broad network primitives can be repurposed to access unintended internal services, exfiltrate sensitive employee data, or invoke external APIs outside the approved workflow.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The generic `add`, `edit`, and `delete` helpers provide broad remote mutation capability without showing any resource-level restriction tied to the manifest’s limited purpose. In this context, a skill intended to detect and report employee emotion fluctuations should not expose arbitrary state-changing API operations, because they could be used to modify or delete unrelated records or trigger unauthorized backend actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This utility code automatically provisions or logs in users by sending identifiers to a remote /sys/phoneLogin endpoint, then persists returned token material locally for reuse. That identity-management and token bootstrapping behavior is unrelated to the stated purpose of employee emotion fluctuation analysis and creates a hidden capability to impersonate or silently enroll identities, expanding privacy and account-abuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code reads a workspace API-key file and derives or creates a current open-id automatically, establishing identity state outside the user-visible workflow. For a surveillance-oriented HR skill, undisclosed identity resolution increases the sensitivity of processing and enables requests to run under hidden identities without clear authorization boundaries.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The default trigger is so broad that any office-camera video URL or file may activate employee emotion analysis automatically. In a workplace-surveillance context, this risks analyzing sensitive footage without a sufficiently explicit request, increasing the chance of accidental surveillance, unauthorized processing, and privacy-law violations.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The history-report keywords are broad and can trigger retrieval of sensitive HR monitoring reports without a tightly bounded request. Given the highly sensitive nature of employee mental-state inference, ambiguous auto-triggering increases the risk of unauthorized disclosure or overcollection.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill auto-saves uploaded attachments and media locally but does not prominently warn users up front. Because inputs are workplace videos potentially containing biometric and behavioral data, silent local storage creates a significant confidentiality and retention risk if the host system is shared, compromised, or not managed under strict retention controls.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation does not prominently warn that history queries directly access cloud APIs for sensitive employee-monitoring data. In this context, undisclosed remote retrieval can surprise operators, expand exposure of behavioral data, and lead to noncompliant disclosure outside expected local processing boundaries.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The script performs hidden identity resolution via `OpenIdUtil.resolve_current_open_id(...)` while the CLI suppresses the `--open-id` help text, meaning operators are not clearly informed that internal identity linkage and employee tracking occur. In the context of emotion surveillance and historical baseline building, this materially increases privacy risk and the chance of covert monitoring, misuse of personnel data, or non-compliant processing of sensitive behavioral information.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The code reads arbitrary local file contents into memory and transmits them to the analysis backend without any user-facing disclosure or consent check in this component. Given the skill's highly sensitive HR/emotion-monitoring purpose, this creates a meaningful risk of silently uploading personal or regulated video data, especially if users misunderstand what will be sent off-host.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The CLI sends user-supplied video content or URLs to an analysis backend without any explicit notice that data will leave the local environment or be processed externally. Because the skill is designed for employee emotion inference from video, the data is highly sensitive biometric/behavioral information, so silent transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The configuration loader silently creates missing files and directories and suppresses exceptions, which can mask unauthorized writes, path mistakes, or tampering with configuration state. In a skill handling sensitive employee-monitoring functionality, hidden filesystem side effects reduce auditability and can allow insecure defaults or attacker-influenced paths to persist unnoticed.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The delete() method performs irreversible hard deletion with no soft-delete flagging, confirmation, audit trail, or authorization checks visible in this layer. In a skill handling highly sensitive employee emotion/behavior data, accidental or unauthorized invocation could destroy records needed for accountability, consent tracking, investigations, or compliance obligations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Reading a sensitive identity value from data/smyx-api-key.txt without disclosure or consent creates a covert dependency on local secrets. If the workspace is shared or compromised, this file can be abused to bind actions to an unintended identity and to access downstream services under that identity.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request helper transmits user-related fields such as pnaUserName and includes authentication headers on outbound HTTP requests without any user-facing notice or purpose limitation in this code. In the context of an HR emotion-monitoring skill, silent external transmission compounds privacy risk because the application already processes highly sensitive behavioral and inferred emotional data.

External Transmission

Medium

• Category: Data Exfiltration

Content

"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):

• Confidence: 94% confidence
• Finding: requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2