Back to skill

Security audit

Infant Stool Color Abnormality (Clay-Pale / Bloody) | 婴儿大便颜色识别(陶土色/血便)

Security checks across malware telemetry and agentic risk

Overview

The skill is related to infant stool-color screening, but it handles sensitive child health media through a cloud service while silently managing identity, report history, and stored tokens.

Review before installing. Use it only if you are comfortable sending infant diaper or stool images, URLs, metadata, and report queries to the configured cloud services, and if silent account/identity creation plus local token storage are acceptable in your environment. Avoid using it with private-network URLs or unrelated files, and require explicit guardian consent and clear retention/deletion expectations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
78% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to use shell execution, local file handling, environment-derived identity behavior, and network/API access, but it declares no explicit permissions or user-visible capability boundaries. This is dangerous because a host system may invoke the skill without adequate consent, sandboxing, or policy review for sensitive actions such as saving diaper images locally and sending them to remote services.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill exposes a history-listing capability tied to an internal user identity, which goes beyond the stated purpose of single-image stool-color analysis and risk alerting. In a medical/infant context, this can reveal prior analyses and sensitive health-related data without clear user consent, increasing privacy and data-minimization risk.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code resolves and uses an internal user identity (`open_id`) even though the declared function is image-based stool-color analysis, not account-linked tracking. Associating infant medical-image analyses with a hidden identity expands collection of sensitive personal data and can enable unauthorized correlation, retrieval, or retention of health-related records.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill accepts arbitrary http/https URLs as input and forwards them for analysis, even though the stated purpose is analyzing locally captured diaper/stool images. This creates a scope mismatch that can enable unintended remote-content fetching, including analysis of third-party content and possible access to internal or sensitive network resources depending on how downstream services retrieve the URL.

Description-Behavior Mismatch

Low
Confidence
89% confidence
Finding
The skill exposes report history/listing functionality beyond the manifest's single-analysis diagnostic purpose, increasing access to accumulated sensitive medical-image metadata and results. Even if intended as convenience, historical enumeration expands the data surface and can leak prior analyses if access control or tenant isolation is weak elsewhere in the stack.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
Generating export URLs for reports and surfacing them in output adds an extra data-exfiltration path not clearly required for the stool-color analysis task. In a medical context, export links may expose sensitive diagnostic content to unintended viewers if the URLs are guessable, long-lived, or not bound to authorization.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The implementation materially diverges from the declared purpose: instead of analyzing still images of infant stool color, it invokes a generic video-analysis workflow and supports remote URL input. In a health-related skill, this mismatch is dangerous because operators may believe they are using a narrowly scoped stool-color detector while the code processes broader video content, increasing privacy exposure and undermining informed consent and safety expectations.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code exposes a history-listing capability keyed by open_id that is not necessary for one-off stool-color detection. For a pediatric health and diaper-imaging context, retaining or exposing prior analyses can leak sensitive medical and child-related data, especially if access control around open_id resolution is weak or unclear.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The CLI advertises itself as a video-analysis tool and requests MP4 inputs, directly contradicting the manifest's image-based infant stool-color analysis claim. In a medical screening context, this inconsistency is risky because it can conceal broader data collection than users expect and can lead to misuse of the tool for unintended surveillance or processing of unrelated sensitive video.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This file exposes broad generic CRUD and arbitrary HTTP wrapper methods that are not constrained to the stated infant stool-color analysis purpose. In a medical-image skill context, such unrestricted network capabilities expand the attack surface for unauthorized data access, exfiltration, or use of the skill as a general-purpose API proxy if other components can influence the URLs or payloads.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The get_user_by_username capability is unrelated to analyzing diaper/stool images and introduces access to identity-related data outside the advertised medical function. In this context, unrelated user-lookup functionality increases the chance of privacy violations, account enumeration, or misuse of the skill for data retrieval beyond user expectations.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This module defines persistent user/account storage and mutation capability in a skill whose declared purpose is infant stool color image analysis. That capability is unrelated to the medical-imaging function and increases privacy and security risk by enabling collection, retention, and modification of user identifiers, emails, tokens, and profile data without clear necessity.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
The code exposes broad CRUD and lookup operations over user records, including updates by username/realname and deletion, far beyond what is justified for detecting abnormal stool color. In the context of a baby-care medical-adjacent skill, unrelated account-management features amplify the blast radius of any misuse, integration mistake, or data handling error.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This shared utility implements identity resolution, workspace discovery, local identity persistence, token handling, and remote API login flows that are not necessary for infant stool-color image classification. In a medical-image-analysis skill, bundling cross-skill account provisioning and backend access expands data collection and remote interaction beyond user expectations, increasing privacy and abuse risk.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code automatically registers or logs in a user against a health backend using synthesized or reused identifiers, then stores returned tokens for later requests. That is a substantial capability unrelated to detecting stool color abnormalities and can create backend accounts and network-side identity linkage without an informed user action.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The utility reads a workspace-level identity file and falls back to local database records to derive a persistent open-id, then can create a new default identity if none exists. For a diaper/stool image analysis skill, accessing and persisting cross-workspace identity artifacts is unnecessary and creates hidden identity state that can be reused across sessions and features.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The history-report trigger list contains broad phrases like viewing report lists or maternal/infant diagnostic reports, which can cause unintended automatic invocation of cloud history retrieval. In a medical/privacy-sensitive context, overly broad triggers increase the risk of fetching and exposing sensitive historical infant health data when the user's intent was ambiguous or unrelated.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill directs analysis through an API and states that URLs are fetched by the service and history is retrieved from a cloud interface, but it does not clearly warn users that infant diaper/stool images and related metadata may be transmitted off-device. Because this involves highly sensitive images of a minor, lack of transparent disclosure and consent materially increases privacy, compliance, and data-handling risk.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
`OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))` initializes internal identity handling without user-facing disclosure, and the related argument is suppressed from help output. Hidden identity resolution is especially risky in a pediatric health context because users may unknowingly trigger account-linked processing of sensitive health information.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The code reads arbitrary local files into memory and submits their contents for analysis without any user-facing notice or confirmation in this file. In a privacy-sensitive healthcare skill, silently transmitting local media can cause accidental disclosure of sensitive infant images or unrelated files if a wrong path is provided.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The debug log prints the full prompt content, which may contain sensitive medical or personal data submitted for infant stool analysis. If debug logging is enabled in production or logs are centrally collected, this can leak protected health information and user inputs to operators or other systems.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
When debug mode is enabled, the code turns on low-level HTTP and urllib3 logging, which can expose request URLs, headers, payloads, and responses in logs. Given this skill may process sensitive infant-health-related data and backend tokens, verbose network logging materially raises confidentiality risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The utility silently reads an internal identity value from data/smyx-api-key.txt and uses it as an open-id source. Hidden reuse of a workspace identity in a health-oriented skill can link activity across runs or users without transparency, which is especially problematic in a sensitive medical context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2