Back to skill

Security audit

Mental Health Analysis Tool | 心理健康分析工具

Security checks across malware telemetry and agentic risk

Overview

The skill matches its advertised mental-health video analysis purpose, but it uploads highly sensitive media, silently binds or creates a user identity, persists tokens, and can retrieve cloud history without enough explicit user control.

Review before installing. Only use this skill if users understand that videos, video URLs, identity metadata, and historical report requests may be sent to an external service and associated with a persistent account. Require explicit consent for each analysis and history lookup, avoid analyzing third-party or highly private videos without permission, and verify the configured service endpoint and data retention/deletion terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
73% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
71% confidence
Finding
query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill manifest advertises and instructs use of capabilities including shell execution, local file handling, environment access, and network requests, but declares no explicit permissions. This creates a transparency and policy-enforcement gap: an agent may execute sensitive operations without a clear least-privilege contract or user-visible authorization boundary.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code performs hidden internal identity resolution via OpenIdUtil.resolve_current_open_id using a suppressed CLI parameter and implicit current-user behavior, which is unrelated to the stated purpose of psychological video analysis. In a sensitive mental-health context, covert identity binding increases the risk of associating highly sensitive analysis data with an internal user account without clear user awareness or consent.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The implementation exposes a history-listing function through show_analyze_list/open_id that goes beyond the advertised video analysis/report generation behavior. For a psychology-analysis tool, access to prior analysis history can reveal highly sensitive mental-health inferences, and broadening scope without clear authorization checks or disclosure raises privacy and data exposure risk.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill exposes a history-listing capability via `show_analyze_list(open_id)` that is not clearly required for the stated purpose of performing a single psychological video analysis. In the context of mental-health analysis, historical result listings can reveal highly sensitive prior analyses and metadata, increasing privacy risk and the chance of unauthorized access if `open_id` resolution or downstream authorization is weak.

Context-Inappropriate Capability

High
Confidence
92% confidence
Finding
This file exposes generic outbound HTTP helpers (`http_post`, `http_put`, `http_get`, `http_delete`) that can send requests to arbitrary caller-supplied URLs, which is far broader than the declared psychology-analysis purpose. In a skill that may process sensitive mental-health/video data, such unrestricted network primitives create a strong exfiltration and unauthorized external-integration risk if other components or prompt flows can influence the target URL or payload.

Context-Inappropriate Capability

High
Confidence
88% confidence
Finding
The `add`, `edit`, and `delete` methods provide generic remote state-changing operations with caller-controlled URLs and arguments, which exceeds an analysis-only mental-health skill's stated function. Such broad CRUD capability could be reused to modify or delete remote resources unrelated to the user-requested analysis, amplifying the risk of abuse if the skill is integrated into a larger agent workflow.

Context-Inappropriate Capability

Medium
Confidence
76% confidence
Finding
The `get_user_by_username` capability is unrelated to mental-health video analysis and introduces account-lookup functionality that could enable user enumeration or unauthorized access to identity-related data. In the context of a psychology tool handling sensitive subjects, even seemingly simple identity lookup broadens privacy risk and expands the attack surface beyond the stated purpose.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The utility code creates, selects, and persists user identities for the local environment even though the advertised skill is psychological/video analysis. This hidden identity management expands the skill's behavior beyond stated purpose, enabling silent account linkage and persistent user tracking without clear user awareness or consent.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The HTTP helper automatically performs login/registration, token acquisition, token reuse, token persistence, and even billing-related handling. For a mental-health analysis skill, this is materially out of scope and dangerous because it can silently create or bind accounts and transmit identifiers and tokens to remote services whenever the helper is used.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill is configured to trigger by default whenever a user provides a video or requests psychological analysis, without strong confirmation gates. In a sensitive health context, broad activation can cause the agent to process intimate media or initiate high-risk analysis unexpectedly, increasing the chance of non-consensual data handling and incorrect workflow execution.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The history-report function auto-triggers on vague phrases like viewing historical reports, then instructs the agent to query cloud-hosted mental-health records directly. Because these are highly sensitive records, accidental invocation could expose private report metadata or links without sufficiently explicit user intent or re-authentication.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill processes videos, images, URLs, and cloud-hosted historical psychological reports, yet the description does not clearly warn about privacy, consent, biometric/health-data sensitivity, retention, or third-party transmission. In this context, the omission is dangerous because users may unknowingly submit highly sensitive mental-health and facial/physiological data for remote analysis.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The tool sends local video paths or remote URLs for psychological analysis while only displaying a generic progress message and no explicit privacy warning, despite processing data that may contain biometric, behavioral, and mental-health information. In this context, users may unknowingly upload extremely sensitive personal content to a backend service, creating significant privacy, consent, and compliance risks.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill reads arbitrary local video files into memory and transmits their contents to a remote analysis service, but this code path contains no explicit user-facing notice, consent check, or data-minimization control. Because the skill’s stated purpose is psychological/mental-health analysis from video, the uploaded content is likely highly sensitive biometric and health-related data, making undisclosed transmission particularly risky.

Missing User Warnings

Low
Confidence
88% confidence
Finding
User-supplied remote video URLs are forwarded directly to the backend analysis service without any disclosure or validation of privacy implications. In this mental-health analysis context, URLs may reference highly sensitive personal videos, and passing them onward can expose private resources or cause the external service to access data the user did not fully understand would be shared.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code reads a sensitive credential/identity value from data/smyx-api-key.txt and uses it as an internal identity source without any visible disclosure to the user. Silent consumption of local secrets can cause unintended account association and covert use of credentials in a context unrelated to the skill's declared purpose.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This code automatically posts identity data to a remote phoneLogin endpoint with silent/register flags, effectively enabling account registration or login without clear user-facing consent. That is especially sensitive in a psychology-analysis context because users may reasonably expect handling of highly personal data, not covert account creation and remote identity provisioning.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The general request helper injects user identifiers, tenant metadata, skill platform metadata, and authentication tokens into outbound requests without visible disclosure in this file. Combined with the skill's sensitive mental-health context, this creates a meaningful privacy and transparency risk because user-linked data may be sent to external services implicitly.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2