Security audit
Security checks for vulnerabilities and agentic risk
This skill performs the advertised remote stress assessment, but it also silently creates and reuses identities, stores tokens locally, and queries sensitive cloud history with limited user-facing consent.
Review before installing. Use only with explicit consent from people whose face media is analyzed, and assume media, derived stress/anxiety/depression signals, identity values, and report history may be sent to and linked by the remote service. Avoid shared or sensitive environments unless you are comfortable with local token/database persistence and cloud report retrieval.
External API communication, auto-registration/login, token or open-id handling, local data discovery, and persistence are materially broader than the declared facial/emotion-based assessment function. In the context of mental-health and biometric data, this creates a severe trust gap and raises the possibility of covert identity linkage, account operations, and sensitive data exfiltration.
External API communication, auto-registration/login, token or open-id handling, local data discovery, and persistence are materially broader than the declared facial/emotion-based assessment function. In the context of mental-health and biometric data, this creates a severe trust gap and raises the possibility of covert identity linkage, account operations, and sensitive data exfiltration.
External API communication, auto-registration/login, token or open-id handling, local data discovery, and persistence are materially broader than the declared facial/emotion-based assessment function. In the context of mental-health and biometric data, this creates a severe trust gap and raises the possibility of covert identity linkage, account operations, and sensitive data exfiltration.
External API communication, auto-registration/login, token or open-id handling, local data discovery, and persistence are materially broader than the declared facial/emotion-based assessment function. In the context of mental-health and biometric data, this creates a severe trust gap and raises the possibility of covert identity linkage, account operations, and sensitive data exfiltration.
External API communication, auto-registration/login, token or open-id handling, local data discovery, and persistence are materially broader than the declared facial/emotion-based assessment function. In the context of mental-health and biometric data, this creates a severe trust gap and raises the possibility of covert identity linkage, account operations, and sensitive data exfiltration.
External API communication, auto-registration/login, token or open-id handling, local data discovery, and persistence are materially broader than the declared facial/emotion-based assessment function. In the context of mental-health and biometric data, this creates a severe trust gap and raises the possibility of covert identity linkage, account operations, and sensitive data exfiltration.
External API communication, auto-registration/login, token or open-id handling, local data discovery, and persistence are materially broader than the declared facial/emotion-based assessment function. In the context of mental-health and biometric data, this creates a severe trust gap and raises the possibility of covert identity linkage, account operations, and sensitive data exfiltration.
External API communication, auto-registration/login, token or open-id handling, local data discovery, and persistence are materially broader than the declared facial/emotion-based assessment function. In the context of mental-health and biometric data, this creates a severe trust gap and raises the possibility of covert identity linkage, account operations, and sensitive data exfiltration.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: "psychological-stress-assessment-analysis"
description: "Combines facial blood flow and emotional characteristics to analyze stress index, anxiety tendency, and depression tendency, suitable for mental health monitoring scenarios. | 心理压力评估技能，结合面部血流与情绪特征，分析压力指数、焦虑倾向、抑郁倾向，适用于心理健康监测场景"
version: "1.0.20"
license: "MIT-0"
---
# 🧘 Psychological Stress Assessment Skill | 心理压力评估技能
> **智能分析中枢** · 图片/视频智能分析 · 结构化报告 · 历史报告云端查询
---
## 🧭 技能概览 | Overview
| 模块
The skill description promotes upload of face media and cloud retrieval of mental-health reports but does not clearly warn about privacy, consent, storage, or sensitivity implications. For biometric and inferred mental-health data, missing disclosures materially increase the risk of uninformed consent and unsafe handling of protected personal information.
The instructions say the system will automatically create and reuse a local default identity when no upstream identity is provided. In a mental-health monitoring context, implicit identity creation and reuse can silently link sensitive assessments across sessions or users, causing privacy violations, mistaken attribution, and unauthorized access to historical reports.
This file exposes generic wrappers for arbitrary POST, PUT, GET, and DELETE operations and CRUD-style helpers without any restriction tying them to psychological stress assessment functions. In the context of a narrowly described mental-health analysis skill, this creates unnecessary remote-action capability that could be reused by other parts of the skill to access or modify unrelated backend resources, expanding the attack surface well beyond the declared purpose.
The add, edit, delete, and generic http_post/http_put methods provide direct remote resource modification capability with attacker-controlled URL/arguments and no visible constraints in this file. For a skill advertised as analysis-only, such mutation capability is unjustified and dangerous because it enables unauthorized creation, update, or deletion of remote data if invoked by higher-level code.
When no user is supplied, the code reads an identity from local files or silently creates a persistent default user and stores it for future reuse. This is dangerous because it manufactures and persists user identity without informed consent, making later network actions attributable to a hidden account and increasing privacy and audit risks.
The utility layer performs remote account provisioning, token acquisition, and local token persistence that are unrelated to the stated psychological stress-analysis purpose. This creates an undisclosed identity and authentication side channel: simply using the skill can register a user, obtain tokens, and bind local state to a remote service without explicit user consent.
The code automatically transmits openId/mobile/source fields to a remote /sys/phoneLogin endpoint to create or retrieve an account, without explicit disclosure or consent. This is dangerous because it sends identity material off-host and can create a remote account as a side effect of local skill execution.
The general HTTP request wrapper injects user identifiers and authentication tokens into outbound requests automatically, without user-facing notice. In a skill for psychological assessment, this materially increases privacy risk because sensitive usage may be linked to persistent identifiers and sent to external services behind generic utility code.
The skill advertises and instructs use of shell execution, network access, local file handling, and environment-backed behavior, but declares no corresponding tool scope or permission boundaries. This creates an under-specified capability surface where an agent may invoke more powerful actions than reviewers or users expect, increasing the risk of unsafe execution and data access.
The default trigger is broad enough that ordinary image or video sharing for assessment-related discussion may automatically invoke a high-sensitivity biometric and mental-health analysis workflow. That increases the chance of unintended processing of face media without sufficiently explicit user intent or consent.
The skill adds cloud-based historical report retrieval beyond the primary assessment function, increasing the amount of sensitive mental-health information exposed through the interface. Historical listing functionality can broaden access to prior reports and enable unnecessary aggregation of highly sensitive personal data.
The API documentation describes a pet health analysis service while the skill is presented as a psychological stress assessment tool for humans. This mismatch can cause the agent or operators to invoke the wrong backend, mishandle sensitive health-related data, or make unsafe assumptions about model purpose and output semantics; in a mental-health context, such confusion is more dangerous because users may rely on the results for wellbeing decisions.
The script includes a hidden --list capability that retrieves analysis records via skill.get_output_analysis_list(open_id=open_id), which is outside the manifest’s stated purpose of analyzing supplied media. Because identity is resolved internally and the option is suppressed/hidden, this can expose prior sensitive mental-health-related records without clear user awareness or authorization boundaries.
The skill sends facial/emotional media for psychological stress assessment, which is highly sensitive biometric and mental-health-adjacent data, yet the user-facing flow only says analysis is in progress and does not clearly warn that data will be transmitted to an external service. In this context, omission of explicit notice and consent is dangerous because users may unknowingly disclose extremely sensitive personal information.
The method returns a fixed Chinese string literal for the output heading, which forces a specific language without any visible user opt-in or locale selection. Per the policy, hardcoding a language choice is a natural-language policy concern unless the constraint is explicitly documented and justified.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
result_json = JsonUtil.parse(result_json_pure_text, result_json_pure_text)
result_json_common_ai_response = result_json.get("commonAiResponse") if isinstance(result_json,
dict) else result_json
if result_json_common_ai_response:
result_json = result_json_common_ai_response
Detected: suspicious.install_untrusted_source