Back to skill

Security audit

Smart Incontinence Status Alert Skill | 智能失禁状态提醒技能

Security checks across malware telemetry and agentic risk

Overview

The skill’s core function is coherent, but it handles sensitive care images through cloud services while silently creating or reusing persistent identities and tokens.

Review this skill carefully before installing. It sends care-related images, videos, or media URLs to Lifeemergence cloud endpoints, can query historical reports, silently creates or reuses an identity, and stores authentication tokens locally. Install only if users and caregivers understand and consent to those data flows, and if the publisher’s privacy, retention, and access-control practices are acceptable for sensitive patient or infant care data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares no permissions while its documented behavior requires shell execution, network access, local file handling, environment access, and likely persistent storage. This under-declaration prevents meaningful user or platform review and is especially risky here because the skill processes highly sensitive medical imagery and report data.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The advertised purpose is visual incontinence detection and caregiver alerting, but the documented behavior extends to remote account/login flows, token handling, persistent local identity creation, historical report retrieval, and export-link generation. This mismatch can mislead users about the true data flows and trust boundary, causing them to provide sensitive patient media without understanding that it is sent to backend services and tied to persistent identities.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The CLI performs hidden identity resolution via OpenIdUtil.resolve_current_open_id and exposes a history-listing mode through --list, while suppressing the related open-id argument from help output. That creates functionality beyond the stated purpose of visual incontinence detection and can enable access to prior analysis records tied to user identity without clear disclosure or authorization boundaries.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill accepts arbitrary local files or remote video URLs for backend analysis and can list prior reports, which exceeds the narrow medical alerting description presented to users. In a healthcare context handling sensitive video, this capability expansion increases the risk of undisclosed data processing, broad surveillance use, or access to unrelated reports beyond what a user would reasonably expect.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The ability to retrieve historical analysis results by open_id introduces a data-access capability beyond the stated real-time alert use case, and in this healthcare-adjacent context those results may contain sensitive video-analysis history. If open_id values are guessable, reused, or insufficiently authorized in downstream code, this can enable privacy violations or cross-user data exposure.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The file defines a generic `ai_chat(prompt, session_id, timeout)` capability inside a common skill module, and that capability is not scoped to the stated incontinence-alert purpose. In an agent ecosystem, exposing a reusable free-form prompt channel increases the attack surface for prompt injection, unintended external model access, or unauthorized task execution if later wired up, especially because the docstring indicates intent to invoke an external agent.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This utility code inspects the workspace environment, reads a local identity file, and creates or reuses persistent user identities unrelated to the stated visual incontinence alert purpose. That creates hidden identity management and local state behavior which can surprise users, broaden data collection, and enable cross-skill/platform tracking without clear consent.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The HTTP helper silently performs account registration/login against an external health platform by sending openId/mobile values and then stores returned tokens locally. This is dangerous because merely using the skill can create external accounts and establish authenticated sessions beyond the user's expectation, especially sensitive in a care/health-related context.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The default trigger is broad enough to invoke the skill whenever a user provides an image, video, URL, or file related to detection language, increasing the chance of accidental activation. In this medical/privacy-sensitive context, unintended invocation could silently route sensitive media into analysis pipelines or cloud services without sufficiently specific user intent.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The historical-report feature auto-triggers on broad natural-language phrases such as viewing reports or records, which can expose sensitive prior caregiving or medical-adjacent data without strong confirmation. Because the skill also auto-associates internal identity and queries cloud data, an ambiguous request may disclose private historical records to the wrong conversational context.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill processes extremely sensitive image/video data involving elderly patients, bedridden individuals, and infants, yet the description does not clearly warn that media and report queries are transmitted to cloud APIs and may be stored or linked to persistent identities. This omission undermines informed consent and creates substantial privacy and compliance risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill forwards local files or remote URLs for analysis to an external service through skill.get_output_analysis without any explicit user-facing warning about data transfer. Because the content concerns incontinence status for elderly, bedridden patients, and infants, the transmitted media is likely highly sensitive health-related imagery, making undisclosed exfiltration especially risky.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads local files into memory or forwards remote video URLs to a backend analysis service without any visible user-facing warning, consent checkpoint, or privacy notice in this path. Because the skill is intended for elderly, bedridden patients, and infants, the transmitted media may contain highly sensitive health and biometric data, making silent upload especially risky.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
When debug mode is enabled, HTTPConnection and urllib3 debug logging are turned on globally, which can expose request URLs, headers, bodies, and responses in logs. In a health-related skill, those logs may contain authentication tokens, user identifiers, or sensitive caregiving data, increasing privacy and credential leakage risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This code reads an internal identity value from a workspace file and later supports persisting generated user identities for reuse, all without an explicit user-facing authentication or consent step. That can silently bind the skill to an internal or shared identity, enabling unintended impersonation, tracking, or unauthorized use of platform resources.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The request helper automatically attaches user identity fields and authentication tokens to outbound HTTP requests. In a healthcare-adjacent skill, silent transmission of identifiers and tokens to external services increases privacy risk and can expose accounts if requests are misrouted, logged, or sent to unnecessary endpoints.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2