Thermal Relative Fever Screening (Multi-Person Gathering) | 家庭多人聚集时体温相对异常检测

• Outcome: Review
• Latest audit: Oct 15, 2026 · 1:43 AM UTC
• Version: 1.0.9

Overview

This skill appears to perform the stated fever-screening workflow through a cloud service, but it also silently creates or reuses identity records and stores tokens for health-related report history.

Install only if you are comfortable sending thermal-imaging videos or video URLs and identity-linked report history to the provider's cloud service. Obtain clear consent from people being monitored, avoid using it in sensitive shared spaces unless retention and access controls are understood, and review how to delete local workspace data and cloud reports before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (58)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The combination of HTTP requests, auth handling, filesystem access, workspace discovery, local identity management, and absent thermal-analysis logic suggests the real behavior is backend orchestration and user tracking rather than the declared fever-screening function. That is particularly dangerous because the skill operates on sensitive health-related video and may silently create identity-linked cloud/local records.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatic creation and reuse of user identities is unjustified for a thermal-screening analysis skill and creates a hidden tracking mechanism. Because the skill handles sensitive health-adjacent media and report history, silent identity persistence enables long-term profiling and unauthorized correlation of analyses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The User model stores identity and authentication-like fields such as username, realname, email, token, and open_token without clear necessity for fever screening. In a public-area thermal monitoring context, collecting and persisting this data materially increases privacy and security risk because compromise would expose sensitive identifiers and tokens unrelated to the advertised function.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code implements open-id discovery, fallback identity generation, workspace file reads, and persistent local user creation, which materially exceeds the stated thermal fever-screening purpose. That expansion of scope creates covert identity management behavior and a foothold for cross-service account linkage without clear user consent or necessity for the declared skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The HTTP utility does far more than transport requests: it performs remote login/registration, fetches and persists tokens, injects user identity into outbound requests, and retries authorization automatically. For a skill advertised as fever-screening analysis, this is unnecessary privileged behavior that can enable undisclosed account creation, data sharing, and broad external platform access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and appears to require shell, file, network, and environment access, but it does not declare any explicit tool scope or least-privilege boundaries. That increases the blast radius of the skill and makes it harder for a host system to constrain risky operations such as arbitrary network fetches, local file handling, and command execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation expands the skill from analysis into cloud history queries and app/report-link delivery, which changes the data lifecycle from transient processing to persistent storage and retrieval. For health-related outputs, that materially increases privacy exposure and should be disclosed as a first-class capability rather than an incidental feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description does not prominently warn that the skill may support continuous surveillance and cloud history queries for sensitive health-related data. Without clear upfront disclosure, users may not understand the monitoring, retention, and privacy implications of using the skill in homes, schools, or care settings.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A default trigger on any uploaded thermal group video can cause the skill to activate without explicit consent for a health-screening workflow. Since this involves potentially sensitive health inference from people in shared spaces, accidental invocation increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The keyword triggers are broad enough to match common contextual phrases, making unintentional activation likely. In this context, that is more dangerous because the skill concerns continuous monitoring and health-related inference, where users and bystanders may not expect automatic analysis or cloud history access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Claiming silent identity initialization, default-user reuse, and auto-creation adds persistent identity management that is not part of the stated thermal-screening purpose. In a health context, this is especially dangerous because it can create hidden user profiles and link sensitive reports across sessions without clear notice or consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script exposes a hidden history-listing mode via --list that retrieves per-user analysis history even though this capability is not described by the skill's stated fever-screening purpose. Undocumented access to historical screening data increases the risk of privacy violations and unauthorized secondary use of sensitive health-related records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script accepts a user-supplied network URL for video analysis without warning the user that remote content may be fetched and potentially transmitted to backend analysis services. In a health-screening context, this can expose sensitive video and inferred health information without meaningful notice or consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill silently resolves and uses an internal open_id identity without clear necessity for the declared task of analyzing thermal video. Binding sensitive temperature-screening operations and history access to a hidden identifier creates a privacy and authorization risk, especially because users are not clearly informed that identity-linked processing is occurring.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code resolves a hidden internal open_id and uses it in user-scoped operations without transparent disclosure to the operator. This is dangerous because it enables covert identity linkage for health-related analysis and history retrieval, undermining privacy expectations and potentially enabling unauthorized access patterns.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2