Workplace Group Stress Heatmap | 职场员工压力群体热力图

• Outcome: Review
• Latest audit: Aug 14, 2026 · 2:50 AM UTC
• Version: 1.0.5

Overview

The skill’s workplace video analysis purpose is disclosed, but it needs Review because it uploads sensitive office footage to a remote service while silently creating or reusing local account identity and token state.

Only install this after a workplace privacy and legal review. Confirm that employees have notice/consent where required, that camera sources are approved, that footage and reports are retained only as intended, and that the local data/smyx-common-claw.db and data/smyx-api-key.txt identity/token behavior is acceptable for your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)

• Confidence: 81% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:

• Confidence: 80% confidence
• Finding: query = query.filter(getattr(self.__model__, key) == value)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use local files, write outputs, access network resources, inspect environment-derived identity context, and invoke shell commands, yet it declares no permissions. This creates a capability/expectation mismatch that can bypass review controls and makes it harder for operators to understand that workplace video and report data may be transmitted or stored.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill accepts arbitrary HTTP/HTTPS video URLs and forwards them for analysis, which broadens the data sources far beyond the stated fixed-camera workplace monitoring use case. This can enable analysis of unapproved remote content, create scope creep around surveillance, and potentially allow the backend to fetch attacker-controlled URLs or external sensitive resources depending on how the downstream service handles videoUrl.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implementation materially exceeds the declared purpose: instead of a constrained workplace-zone stress heatmap pipeline, it exposes a generic video-analysis entry point for local files and arbitrary URLs plus history retrieval. This kind of scope mismatch is dangerous because reviewers, deployers, and users may grant permissions or trust based on the manifest while the code enables broader surveillance or analysis workflows than disclosed.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Accepting arbitrary network video URLs broadens the skill from fixed enterprise cameras to unrestricted remote content ingestion. That can be abused to analyze unauthorized third-party footage, bypass expected source controls, or trigger server-side fetching of attacker-chosen URLs with privacy and potential SSRF-style downstream risk depending on how skill.get_output_analysis handles remote retrieval.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The history-listing function exposes an additional data access capability not described in the manifest's real-time/hourly heatmap purpose. Undisclosed access to prior analyses can increase privacy risk, enable broader employee monitoring over time, and defeat expectations of limited, aggregate-only processing in this workplace context.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This class exposes generic HTTP GET/POST/PUT/DELETE primitives that can reach arbitrary URLs, which is far broader than the declared purpose of generating workplace stress heatmaps. In an agent skill context, such unrestricted network capability can be repurposed for data exfiltration, command-and-control style communication, or interaction with unintended internal/external services, especially because the surrounding skill handles sensitive employee-derived analytics.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The add/edit/delete methods provide broad remote state-changing capability without any visible restriction tying them to the documented analysis-only use case. In a skill that is supposed to analyze camera-derived stress signals, generic mutation operations increase the attack surface and could be abused to alter remote resources, records, or configurations unrelated to the stated function.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file includes persistent user-account storage and mutation functions (username, realname, email, token, open_token) that are unrelated to a workplace stress heatmap skill. This creates unnecessary retention and manipulation of identifiable and credential-like data, expanding the attack surface and enabling function creep beyond the manifest's stated purpose. In the context of employee monitoring, that excess capability materially increases privacy and insider-abuse risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says the system performs anonymous analysis, but the code defines a User model storing directly identifiable fields such as username, realname, email, birthday, age, token, and open_token. That contradiction indicates the skill may process or retain personal data beyond what users and operators were told, undermining anonymity claims and creating significant privacy, compliance, and trust risks. In an employee stress-monitoring context, linking stress signals to identities is especially sensitive.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility layer performs authenticated remote API access, automatic login/registration, and token handling that are unrelated to the declared purpose of anonymous workplace stress heatmap generation. In this skill context, hidden account provisioning and outbound identity-bearing traffic materially expands data-handling scope and creates an unjustified channel for employee/workspace metadata exfiltration.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code creates or reuses persistent user identities via local files and a database even though the skill claims anonymous group-level analysis. Establishing durable identifiers undermines the stated anonymity model and can enable linking runs, workspaces, or operators over time without clear necessity.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The request path loads, refreshes, and persists remote authentication tokens and user records locally. For an anonymous analytics skill, this is an unjustified privileged capability that increases the blast radius of compromise and creates a durable authentication footprint unrelated to the manifest’s stated use.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring openly describes assigning a default user identity when no open-id is provided, which conflicts with the manifest’s claim of anonymous analysis. While the docstring itself is not executable, it accurately signals identity-establishing behavior that is risky and misleading in this skill context.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The default trigger activates whenever a user provides office camera media for analysis, even without clear, informed intent to perform stress inference. Because this skill processes privacy-sensitive workplace surveillance data and derives sensitive behavioral/health-adjacent conclusions, broad auto-activation increases the chance of non-consensual or inappropriate use.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The keyword triggers include broad terms such as workplace wellness, burnout, and organizational health, which can match benign analytics requests that do not justify camera-based stress inference. In this context, ambiguous triggering is dangerous because it can silently escalate ordinary office-video analysis into sensitive employee monitoring.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill describes uploading local files or URLs and generating cloud-queryable reports, but it does not prominently warn users that workplace video containing employees will be remotely processed and may reveal sensitive emotional or health-related inferences. Missing disclosure undermines informed consent and increases legal, privacy, and employee-surveillance risk.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The skill operationalizes fixed-camera monitoring of employees' facial expressions and posture to infer stress across workstation zones, which is a form of workplace surveillance involving sensitive psychological or health-adjacent traits. Although it claims anonymity and group aggregation, repeated zone-level monitoring can still enable coercive oversight, re-identification in small groups, and misuse for labor management or performance pressure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script supports a hidden --open-id parameter and initializes identity context through OpenIdUtil.resolve_current_open_id(...) while suppressing the parameter from help output. That creates an undisclosed mechanism to run listing operations under an internal user context, weakening accountability and creating risk of unauthorized access to other users' analysis records or tenant-scoped data.

Missing User Warnings

High

• Confidence: 88% confidence
• Finding: The tool accepts a remote video URL and passes it into downstream analysis without any visible privacy notice, consent gating, or data-handling disclosure, despite processing workplace camera footage and inferred stress signals. In this context, transmitting employee video or derived biometric/behavioral data to a backend service can create serious privacy, compliance, and surveillance harms if operators are unaware of where the data goes or how it is retained.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code reads arbitrary local file contents into memory and uploads them for external analysis with no visible consent prompt, disclosure, or user-facing warning in this component. In a workplace surveillance context involving employee video, silent exfiltration of local media materially increases privacy and compliance risk, especially if operators may misunderstand the destination or sensitivity of the upload.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The CLI accepts a hidden --api-key parameter suppressed from help output, which obscures credential use from operators and reviewers. Hidden credential paths reduce transparency, make misuse harder to detect, and can lead to insecure invocation patterns or undocumented secret handling in logs, shell history, or automation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code silently reads an identity value from a local file and uses it to establish internal identity for subsequent operations. In the context of a purportedly anonymous employee stress analytics skill, this hidden identity bootstrap weakens anonymity guarantees and can enable tracking or cross-run correlation.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Automatically creating and persisting a default user identity without explicit notice is dangerous because it converts an anonymous workflow into an attributable one behind the scenes. In this workplace-monitoring context, that hidden persistence raises privacy, compliance, and misuse risks, especially if linked with remote authentication and API activity.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skills/smyx_common/scripts/config-dev.yaml:2