Thermal Relative Fever Screening (Multi-Person Gathering) | 家庭多人聚集时体温相对异常检测

• Outcome: Review
• Latest audit: Aug 27, 2026 · 3:46 AM UTC
• Version: 1.0.6

Overview

The skill’s fever-screening purpose is understandable, but it uploads sensitive video for remote analysis while silently creating or reusing user identities and storing session tokens locally.

Review this before installing if the videos may contain people, health information, children, employees, or guests. Use it only if you trust the publisher and backend service, can change or verify the configured endpoints, understand that local account/token data may be created in the workspace data directory, and have consent from people being recorded.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 79% confidence
• Finding: This code applies filters using getattr(self.__model__, key) where key comes from the caller-provided filters dictionary. Although SQLAlchemy prevents classic SQL injection here, unvalidated attribute selection can let callers query on unintended columns, bypass business restrictions, or trigger exceptions for bad attributes, which becomes risky in a generic DAO reused across skills.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 79% confidence
• Finding: As in list(), this count() method lets the caller choose arbitrary model attributes through the filters dictionary. In a shared generic DAO managing identity records, that can enable unauthorized metadata probing or policy bypass if higher layers pass attacker-controlled field names.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises powerful capabilities including shell execution, file access, environment access, network access, and file writing, yet declares no permissions or constraints. This creates an opaque trust boundary where users and reviewers cannot easily understand that the skill can access local data, invoke scripts, and communicate with remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is thermal fever screening, but the behavior includes backend authentication, auto-registration/login, local token and identity storage, environment-based identity retrieval, and cloud history access. This hidden expansion of scope involves sensitive identity and health-related data processing that users would not reasonably expect from a simple analysis skill, increasing privacy, data exfiltration, and account misuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The documentation broadens the skill from local/group temperature analysis into cloud history-report querying and retrieval of report links. Because the reports concern health screening, adding remote lookup capabilities increases exposure of sensitive historical data and expands the attack surface beyond what the primary function implies.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Automatic creation or reuse of an internal default user identity is unjustified for a thermal screening skill and can silently bind sensitive health-related outputs to the wrong account. In shared environments, this risks unauthorized access to prior reports, cross-user data leakage, and covert persistence of identity and token state.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code for a human fever-screening skill accepts a 'pet_type' parameter and mutates a global default used by the underlying skill, which indicates code reuse from an unrelated domain and creates semantic mismatch in security-sensitive processing. In a health-analysis context, hidden or unrelated mode switches can cause the wrong model/path/configuration to be applied, leading to inaccurate screening results, policy bypass, or misuse of downstream logic that assumes animal-vs-human categories.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The CLI presents the tool as human body-temperature anomaly analysis while still exposing the category as 'pet type', which is a deceptive or at least dangerously inconsistent interface for a health-related workflow. This mismatch can mislead operators into trusting outputs generated under the wrong classification settings, increasing the chance of false alerts or missed fever cases in a public-health screening scenario.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them to the backend analysis service, which expands the capability beyond the declared fixed-camera/public-area screening workflow. This creates a scope-creep and data-ingestion risk: users can analyze remote or unexpected content, potentially including third-party surveillance feeds or sensitive videos, without any restriction to trusted camera sources.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The skill exposes report listing and export-link generation functionality that is not described in the fever-screening manifest. While not inherently exploitable by itself, undocumented access to historical reports and export URLs increases the chance of privacy overreach, unintended data exposure, and misuse of screening results beyond the narrowly stated purpose.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The implementation materially exceeds the stated purpose of fixed thermal fever screening. It acts as a generic video-analysis client that accepts arbitrary local files or remote URLs and exposes analysis-history retrieval, creating a capability mismatch that can enable broader surveillance or opaque processing of unrelated video data. In a public-area thermal screening context, this is more dangerous because users may reasonably expect narrowly scoped fever detection rather than general-purpose video submission and history access.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Allowing arbitrary remote video URLs is not necessary for a fixed installed-camera screening workflow and expands the attack and misuse surface. It can be used to submit unrelated third-party video, trigger unexpected server-side fetching behavior, or bypass assumptions that the system only analyzes local camera output. In this skill context, the mismatch between advertised fixed-camera operation and generic URL ingestion increases the privacy and trust risk.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The history-listing feature is outside the described fever-screening behavior and may expose prior analysis metadata or results beyond the immediate screening task. In a health-adjacent/public-area monitoring context, retaining and listing prior analyses increases privacy sensitivity and can enable unauthorized visibility into past monitored subjects or sessions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This file exposes broad generic network and CRUD wrappers (`add`, `edit`, `delete`, `http_post`, `http_put`, `http_get`, `http_delete`) that are not constrained to the stated thermal fever-screening purpose. In an agent skill context, such reusable arbitrary HTTP capabilities materially expand the skill's authority and can be repurposed for unrelated data access or outbound actions, especially if higher-level code can supply attacker-controlled URLs, payloads, or API targets.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The `get_user_by_username` capability enables user-account lookup that is unrelated to detecting anomalous skin temperature in public-area thermal imagery. In a skill with no clear identity-management need, this creates unnecessary access to user information and can support account enumeration, correlation of identities with health-related observations, or privacy-invasive profiling.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file defines a generic user DAO and stores identity and authentication-related fields such as username, realname, email, token, and open_token, which are unrelated to thermal fever-screening. In this skill context, collecting and persisting unrelated personal and token data expands the privacy and breach impact surface without a clear necessity, violating data-minimization principles.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Handling token and personal-profile storage inside a fever-screening skill is unjustified by the stated functionality of comparing thermal readings within a scene. Because the skill operates in a public-area health-monitoring context, combining health-adjacent observations with profile and token data materially increases privacy risk and the consequences of compromise or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file exposes a general-purpose `ai_chat(prompt, ...)` method that accepts arbitrary prompts and is not constrained to the stated thermal fever-screening function. In a skill intended for narrowly scoped thermal anomaly detection, this creates unauthorized capability expansion and increases the attack surface for prompt-based abuse, data exfiltration, or misuse of the host agent beyond the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This utility file contains broad remote account provisioning, token bootstrap, and generic authenticated API request logic that materially exceeds the declared thermal fever-screening purpose. In a public-area temperature analysis skill, bundling hidden identity and remote service capabilities increases the attack surface and enables covert data exfiltration or unauthorized backend use under the user's environment.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code reads and creates persistent user identity records, including generating fallback open IDs and storing/reusing them locally. That behavior is unrelated to simple fever anomaly detection and creates privacy and tracking risk by silently assigning persistent identities that can later be used for remote authentication or correlation.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The workspace discovery helpers inspect environment variables, derive workspace roots from filesystem structure, and create data/skills directories. For a thermal-analysis skill, these capabilities are overbroad and can facilitate unauthorized access to broader agent workspace contents or installation surfaces beyond the skill's stated function.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends either uploaded file contents or a remote video URL to the analysis service with no visible user-facing disclosure, consent, or warning in this path. Given the skill processes thermal/health-related imagery in public settings, silent transmission raises significant privacy and compliance concerns because sensitive biometric or health-adjacent data may be transferred off-device or to external services unexpectedly.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The code resolves an OpenID-derived identifier implicitly without presenting any user-facing notice about what identifier is being used or why. In a system processing potentially sensitive video and health-adjacent screening results, silent identifier resolution weakens informed consent and can lead to unexpected account linkage, tracking, or access to another user's analysis context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill submits video for analysis without warning the user that content may be transmitted to an external API or service. Because the advertised use involves thermal/video capture in public or domestic spaces and potentially health-related inferences, undisclosed network transmission materially increases privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code silently reads a workspace API-key-related file to derive an internal identity value, without any user-facing disclosure or consent flow. Even if not directly transmitting the file contents at that point, using hidden local secrets to establish identity is a privacy and secret-handling concern in a skill whose stated purpose is temperature screening.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2